How to Block Malicious and Unwanted Sites with DNS Filtering
Practice4 minInnovialabs editorial team
In short
A DNS filter refuses to return addresses for dangerous or banned domains, so the site simply does not open; set up a filtering cloud DNS or your own Pi-hole/AdGuard Home on the router and close the bypass routes — other DNS servers, DoH and VPNs.
The short answer
Before opening a site, a device asks a DNS server for the domain's IP address. A DNS filter checks the domain against lists: if it falls into "malware", "phishing", "ads" or your own blocklist, the server does not return the real address. The site does not open, and a malicious page never starts loading.
It is a cheap, simple protection layer for the whole office: configure it once on the router and it covers every device on the network.
What DNS filtering can and cannot do
It can:
- block known malware and phishing domains;
- close off site categories: gambling, adult content, social media during work hours;
- strip ads and trackers at the network level;
- show a query log — which devices are reaching which domains.
It cannot:
- block a single page on a domain — only the whole domain;
- inspect the contents of downloaded files;
- protect against a site that is not yet on any list;
- work if a device uses a different DNS server or a VPN.
So a DNS filter complements antivirus, updates and staff training — it does not replace them.
Cloud DNS or your own server
| Criterion | Filtering cloud DNS | Pi-hole / AdGuard Home |
|---|---|---|
| Where it runs | At the service provider | On your mini PC, NAS or server |
| Setup | Enter DNS addresses in the router | Install, configure lists, point the router to it |
| Site categories | Usually ready-made, maintained by the service | Depend on the lists you add |
| Logs | In the service dashboard | Locally, with you |
| Protection outside the office | Often via device agents | Only on the office network or over VPN |
| Maintenance | Minimal | Updates, config backups |
| If the server goes down | The service handles it | The office loses internet unless there is a fallback |
The cloud option suits offices without someone to maintain a server. There are free filtering resolvers with ready profiles (for example, malware blocking only) and paid services with a dashboard, categories and per-device reports.
Pi-hole and AdGuard Home are popular self-hosted tools. AdGuard Home supports encrypted DNS protocols and parental controls out of the box; Pi-hole is known for flexible list handling. Both give full control and local logs, but need upkeep.
How to roll it out
- Pick a solution and write a policy: what you block (security is mandatory, everything else is agreed with management).
- Set the filtering DNS in the router's DHCP settings so every device receives it automatically.
- If you run your own server, give it a static IP and plan for what happens when it goes offline. Two instances are more reliable.
- Test with a known blocked domain that the block works.
- Keep an allowlist for false positives and a clear way for staff to report them.
How to prevent bypass
Any user can type in a different DNS server. To make the filter more than a formality:
- block outbound DNS (port 53, TCP and UDP) on the router for everything except your DNS server, or redirect those queries to it;
- block DNS-over-TLS (port 853);
- DNS-over-HTTPS is harder because it travels over ordinary port 443. Use lists of known DoH providers to block them and disable "secure DNS" in browsers through group policies;
- restrict VPNs and proxies — many filtering services have a category for them;
- remove local admin rights on work computers so staff cannot change network settings.
A quick check that a blocked domain does not return a real address:
nslookup example-blocked-domain.com 192.168.1.2
Instead of the real IP you will see 0.0.0.0 or the address of a block page, depending on settings.
Common mistakes
- A single local DNS server with no fallback: it reboots and the office has no internet.
- Overly aggressive lists that break work services, with no allowlist.
- The filter is in place, but port 53 is open to the outside and bypassing takes a minute.
- Forgotten devices with static DNS settings that must be reconfigured by hand.