Management · Management Operations

Secure DNS and web filtering

Secure DNS protection against malicious destinations, alongside content filtering and acceptable-use policies for the network and device paths in scope.

Features and benefits

Feature	Practical benefit
Secure DNS and malicious-domain blocking	Screens DNS requests against threat intelligence to help block malware, phishing and botnet destinations before a connection is made.
Content and acceptable-use filtering	Category and domain rules control access to inappropriate or unwanted sites while preserving approved business access.
Policies by location, group or user	Granular policies apply the right access rules to the intended population where identification is configured.
Off-network protection	Supported roaming-device deployment can keep the same DNS protection when a device leaves the office network.
Exceptions and request reporting	Controlled allow/block lists and request reports support business exceptions, threat investigation and coverage checks.

Evidence to retain

Dated DNS request records showing effective policy and threat or category action
Successful resolution, approved threat-block and category-block tests for relevant paths
Approved exceptions, coverage gaps and corrective-action retests

The operating check

Verify normal DNS resolution, an approved malicious-domain test and a separate category-block test, then confirm the policy and records for each protected path.

Follow the RDA workflow

RDA VISUAL GUIDE

Secure DNS and web filtering

Separate secure DNS threat protection from content policy, then verify the protected paths.

Open & zoom ↗Download SVG ↓

Requirements → deployment → operation → validation

Document library

Requirements and security baseline

Secure DNS and web filtering Requirements and security baseline

Baseline alignment. Email and web protection safeguards selected for the agreed CIS IG. CIS IGs

Protected networks, DNS resolvers, roaming devices and accountable owners
Malicious-domain protection and acceptable-use categories with approved exceptions
Policy attribution, bypass controls, availability and request-record retention

Deployment and control mapping

Secure DNS and web filtering Deployment and control mapping

Scope and ownership: Secure DNS protection against malicious destinations, alongside content filtering and acceptable-use policies for the network and device paths in scope.
Approved rollout and acceptance: Pilot secure DNS path, threat protection and content-filtering policy; successful resolution plus approved threat-block and category-block tests
Applicable requirements mapped to configuration, validation evidence and approved exceptions

Client and user guide

Secure DNS and web filtering Client and user guide

What a blocked request means and how to request review
Reporting a suspected malicious site or access issue
Approved use and exception responsibilities

Technician training outline

Secure DNS and web filtering Technician training outline

Policy assignment, request tracing and filter decisions
Resolver path checks and coverage troubleshooting
Authorized exceptions and controlled policy changes

RDA technician workflow

Secure DNS and web filtering RDA technician workflow

Identify and assess the requirement; plan the scope, accountable owner and required approvals
Implement and verify: Verify normal DNS resolution, an approved malicious-domain test and a separate category-block test, then confirm the policy and records for each protected path.
Document the configuration and result; hand off operation, review exceptions and plan lifecycle changes

Portal and access training

Secure DNS and web filtering Portal and access training

Client boundaries and least-privilege operator access
User or network attribution configuration
Access review, service credentials and reporting permissions

Training module template

Secure DNS and web filtering Training module template

Learning objectives and prerequisites: policy assignment, request tracing and filter decisions
Authorized practical exercise: Verify normal DNS resolution, an approved malicious-domain test and a separate category-block test, then confirm the policy and records for each protected path.
Knowledge check, observed result and instructor or responsible-owner sign-off

Basic installation and acceptance

Secure DNS and web filtering Basic installation and acceptance

Approved resolver or device-agent prerequisites and protected locations
Pilot secure DNS path, threat protection and content-filtering policy
Successful resolution plus approved threat-block and category-block tests

Advanced deployment and changes

Secure DNS and web filtering Advanced deployment and changes

Location, group or user policies and controlled exception handling
Supported off-network protection for included roaming devices
Staged resolver, device-agent or policy changes with rollback

Technical configuration and integrations

Secure DNS and web filtering Technical configuration and integrations

DNS resolution path, upstream dependencies and bypass controls
Identity mapping, roaming-device configuration and report delivery
Request logging, diagnostic checks, exports and retention settings

Operational audit and checklist

Secure DNS and web filtering Operational audit and checklist

Coverage and operating checks: resolver availability, request freshness and dns bypass paths
Evidence sample: dated dns request records showing effective policy and threat or category action; approved exceptions, coverage gaps and corrective-action retests
Review date and owner; pass or fail, exceptions, corrective action and retest evidence

Tabletop exercises

Secure DNS and web filtering Tabletop exercises

A client device bypasses the intended DNS path
Filtering blocks a business-critical site
An outage interrupts name resolution or web access

Response playbook

Secure DNS and web filtering Response playbook

Determine whether the issue is policy, resolution or coverage
Authorize an exception or corrective change with a rollback path
Retest permitted and blocked behavior and document the result

Operational runbooks

Secure DNS and web filtering Operational runbooks

Trace DNS resolution to its effective security and content policy
Apply an approved exception with ownership and expiry
Restore the protected DNS path and repeat resolution and blocking tests

Evaluation and lifecycle review

Secure DNS and web filtering Evaluation and lifecycle review

Selection and fit. Compare viable options against the business need, security requirements, existing systems and full operating cost. Record the reasons for the selection, the tradeoffs accepted and the conditions that would prompt a different choice.

Keeping the choice current. Follow supplier notices between scheduled reviews and reassess before renewal or a material change. Check ownership changes, renamed or retired products, subscription and licensing terms, pricing, capabilities and support commitments. Record the effect on security, data handling, integrations and service continuity. Assign an owner to approve adjustments or plan a transition, including data export and removal of access.

Selected product edition and protected-path coverage
Filtering accuracy, attribution and exception workload
Availability, reporting limits and operating cost

All IT Systems