Amar Jeer

DNS-Based Filtering Explained: How It Works, Where It Wins, and Where It Breaks (2026)

September 18, 2026

MIN READ

DNS-Based Filtering Explained: How It Works, Where It Wins, and Where It Breaks (2026)

DNS-based filtering is the practice of intercepting DNS queries and blocking lookups to malicious or policy-violating domains before a device ever connects to them. It is fast, simple, and effective as a first layer of web security. In 2026, with roughly 95 percent of web traffic encrypted, DNS-based filtering is necessary but no longer sufficient on its own: it cannot read a URL path, a file upload, an AI prompt, or the header that separates a corporate ChatGPT login from a personal one. dope.security keeps DNS-layer blocking and adds the layers DNS cannot see, all on the device, with no cloud proxy detour.

This explainer covers how DNS filtering works, the three ways it is deployed, where it wins, where it breaks, how the main DNS filtering products compare, and what has to sit on top of it. If you are evaluating a DNS filter as your only web control, read the "where it breaks down" section twice. If you already run one and are deciding what comes next, beyond DNS filtering: the endpoint SWG is the follow-on.

How DNS-based filtering works

Every internet connection starts with a DNS lookup that translates a domain (example.com) into an IP address. DNS-based filtering intercepts that lookup and decides whether to resolve it.

If the domain is on a block list (malware, phishing, content category, custom policy), the resolver returns a sinkhole IP that points to a block page. If the domain is allowed, the resolver returns the real IP and the connection proceeds normally.

The decision happens in milliseconds. There's no decryption, no payload inspection, no per-byte cost. Just a fast lookup against threat intelligence. That speed is the whole appeal, and it is real. The limitation is equally real: once the resolver says yes, the DNS filter's job is over, and everything that happens on the resulting encrypted connection is invisible to it. For the underlying mechanics of resolvers, see recursive vs authoritative DNS and what is DNS security.

Three deployment models

Recursive resolver substitution. Configure your network or devices to send DNS queries to a security-focused recursive resolver. Examples: Cisco Umbrella, DNSFilter, Cloudflare Gateway, Quad9. Simple to turn on at the office router; harder to guarantee once the laptop leaves.

DNS sinkholing. Operate your own DNS resolver and return non-routable IPs for known-bad domains. Common in security-mature enterprises with the staff to maintain the lists.

Endpoint DNS interception. An agent on the endpoint intercepts queries locally and applies policy before forwarding. Useful for off-network coverage, and the pattern every roaming client (Umbrella's included) uses to follow the user home.

Where DNS-based filtering wins

Four strengths.

Speed. The block decision happens before any TCP connection is established. Zero perceptible user latency.

Protocol coverage. Every protocol that uses DNS gets some protection. Not just web browsers: mail clients, update services, and malware beaconing to a command-and-control domain all start with a lookup.

Operational simplicity. Network-level DNS forwarding deploys in minutes. No per-device agents required for that model.

Defense in depth. Even when other layers fail, blocking at the DNS layer stops the attack chain at step one. This is why dope.security does not argue against DNS filtering; it argues against stopping there.

Where DNS-based filtering breaks down

Five gaps that matter in 2026.

HTTPS hides the payload. Once a TCP/TLS connection is established to an allowed domain, DNS filtering has no visibility into what's flowing over it. Roughly 95% of web traffic is encrypted [Documented]. Cisco's own documentation states that Umbrella's DNS layer cannot read URLs or payloads and that full inspection requires the SIG secure web gateway add-on plus SSL decryption and a root certificate [Documented]. The gap is explored in Cisco Umbrella DNS filtering vs HTTPS inspection.

Phishing on legitimate hosts. Attackers host phishing pages on AWS, Google Sites, Microsoft Forms, SharePoint and similar legitimate domains that DNS filtering won't block, because blocking them would break the business.

DoH bypass. DNS-over-HTTPS lets users, and malware, bypass network-level DNS controls by sending lookups inside ordinary HTTPS to a public resolver. Some browsers and operating systems default to DoH. The mechanics and the fix are in how DoH bypasses DNS filtering.

SaaS account distinction. DNS can't tell which account is logged in on a shared domain. Personal vs enterprise ChatGPT looks identical at the DNS layer: same hostname, same IP. Distinguishing them requires an HTTP header inspected or injected inside the decrypted TLS session, which Cisco document 225162 confirms needs the intelligent proxy, SSL decryption and a root certificate rather than DNS alone [Documented].

AI prompt content. Even when DNS allows the request, the actual data leaving the device through a prompt or upload requires endpoint DLP to inspect. A DNS filter cannot tell a harmless question from a pasted customer list.

DNS filtering products compared

The products in this category are honest about what they do; the trouble starts when a DNS filter is bought as if it were a secure web gateway. Each option below is described in self-contained sentences so the comparison stands on its own.

Cisco Umbrella

Cisco Umbrella is the most widely deployed DNS filtering product, built on the OpenDNS resolver network. Its base tier is DNS-layer only, and Cisco's documentation is explicit that URL, payload and tenant visibility require the SIG add-on with SSL decryption [Documented]. Its January 19, 2025 global disruption was caused by a DNS failover misconfiguration, documented in Cisco Field Notice FN74221 [Documented]. Pricing is the most common dislike in reviews [Documented+Sentiment], and Cisco is now migrating customers toward Cisco Secure Access. The full picture is in what is Cisco Umbrella and the top Cisco Umbrella alternatives.

DNSFilter

DNSFilter is a DNS-layer filtering service with a roaming client for off-network devices and AI-assisted domain categorization. It is priced and positioned as a DNS filter rather than a full SWG, which makes it a clean first layer and an incomplete only layer. Where it fits and what replaces it is covered in DNSFilter alternatives.

Cloudflare Gateway

Cloudflare Gateway offers DNS filtering as its entry tier and HTTP inspection through the WARP client on higher tiers. Its tenant control for SaaS accounts works by header injection and is documented for Google and Microsoft only [Documented], and its full DLP and log retention are gated to Contract plans [Documented]. Cloudflare's November 18, 2025 outage, its worst since 2019, showed the shared-infrastructure risk of a uniform anycast network [Documented]. See Cloudflare Gateway alternatives.

dope.security

dope.security is not a DNS filter; it is an on-device Secure Web Gateway that includes the DNS-layer outcome and everything above it. The dope.endpoint agent performs SSL inspection on the device, so it reads URL paths, file uploads and AI prompts, enforces Cloud Application Control tenant restriction (allow corporate ChatGPT, block personal, on the same domain), and runs Dopamine DLP (US Patent 12,464,023) against prompt content through zero-retention APIs. There is no cloud proxy to reach, so there is no added latency and no data center outage to inherit. It runs in under 100 MB of RAM and delivers up to 4x performance over legacy proxy SWGs.

Why the layer above DNS should run on the device, not in a cloud proxy

The usual upgrade path from DNS filtering is a cloud proxy SWG: Umbrella SIG, Zscaler, Netskope. That adds the inspection DNS lacks, but it adds it in a vendor data center, so every request now detours to a point of presence and back. Measured cloud proxy latency runs 40 to 80 ms near a PoP and 150 to 400 ms far from one, and the detour is paid on every request, all day. Teams that liked DNS filtering precisely because it was invisible to users tend to hate the proxy hop for the same reason.

The on-device alternative keeps the thing people liked about DNS filtering, zero perceptible latency, and adds the inspection it lacked. Inspection happens on the laptop, traffic goes from the laptop to the destination, and the only thing that travels to the cloud is policy and logs. The trade-offs are laid out in enterprise web filter vs DNS vs SWG.

Measure the difference: the Fly-Direct Speed Test times your real round-trip latency in the browser and shows what a cloud proxy hop would add to common apps. See how Fly Direct removes the hop, or book a 20-minute demo.

Takeaway: DNS filtering adds no latency and no inspection; a cloud proxy adds both; on-device inspection adds the inspection without the latency.

What goes on top of DNS-based filtering

Three layers complete the stack.

HTTPS inspection. Decrypt and inspect TLS traffic for payload-level visibility. On-device inspection (dope.SWG) avoids the backhaul that cloud-proxy SWG introduces.

Cloud Application Control. Restrict access to approved enterprise tenants of ChatGPT, Claude, Google, Microsoft, Dropbox, Box. How tenant restriction works for ChatGPT.

Endpoint DLP. AI-powered classification of prompt content and file uploads. Meet Dopamine DLP.

The complete stack in one console: dope.SWG. Detailed architecture in the Secure Web Gateway 2026 explainer. For what the move looks like in practice, Greylock Partners replaced DNS-only filtering with on-device inspection and went from first proposal to signed contract in 27 days.

Frequently Asked Questions

What is DNS-based filtering?

The practice of intercepting DNS queries and blocking lookups to malicious or policy-violating domains. Block decisions happen before any TCP connection is established, which makes it fast and invisible to users, and also means it sees nothing after the connection is allowed.

What's the difference between DNS-based filtering and content filtering?

DNS filtering blocks domains. Content filtering inspects the actual content being served (URL paths, page content, file types), which requires HTTPS decryption to be useful. dope.security performs that decryption on the device rather than in a cloud proxy.

Is DNS-based filtering enough?

Not in 2026. DNS-based filtering is a necessary first layer but cannot inspect HTTPS payloads, distinguish SaaS accounts, or stop AI prompt content. Full SWG is the rest of the stack, and dope.security delivers it on the endpoint without a proxy detour.

Can attackers bypass DNS filtering?

Yes. DNS-over-HTTPS (DoH), direct IP connections, custom resolvers, or VPNs can all bypass network-level DNS filtering. Endpoint enforcement closes most of those gaps because it sees the traffic regardless of which resolver answered the lookup.

Is DNS-based filtering the same as Cisco Umbrella?

Cisco Umbrella is one of the most widely deployed DNS-based filtering products. There are others: DNSFilter, WebTitan, Cloudflare Gateway, Quad9. Top 10 Cisco Umbrella alternatives in 2026.

What's better, DNS-based filtering or URL filtering?

They solve different problems. DNS blocks the address; URL filtering reads the path. Modern SSE platforms do both. URL filtering vs DNS filtering covers the comparison.

Can DNS filtering block personal ChatGPT but allow the company account?

No. Both accounts use the same hostname, so a DNS filter must allow or block chatgpt.com for everyone. Separating them requires inspecting the HTTP header inside the decrypted session, which Cisco's own documentation says needs the proxy and SSL decryption rather than DNS. dope.security does it on the device with Cloud Application Control.

Does adding inspection above DNS filtering slow users down?

It does if the inspection runs in a cloud proxy, because every request then detours to a data center: 40 to 80 ms near a point of presence and 150 to 400 ms far from one. It does not if the inspection runs on the device, which is how dope.security keeps the zero-latency feel of DNS filtering while adding URL, upload and prompt visibility.