Skip to main content

DNS Filtering

Overview​

DNS Filtering blocks access to malicious and unwanted websites by intercepting DNS queries. Stop threats before they reach your network.

How DNS Filtering Works​

Query Flow​

1. User types URL → 2. DNS Query → 3. Bastion DNS → 4. Check Policy
                                                         ↓
5. Block Page ← (if blocked) ← 6. Response
         or
5. Resolved IP ← (if allowed) ← 6. Response

Protection Layers​

LayerProtection
Threat IntelligenceKnown malicious domains
Category FilteringContent categories
Custom RulesYour allow/block lists
AI DetectionNewly registered domains

Setup​

DNS Configuration​

Option 1: Device Agent​

Endpoints with Bastion agent automatically use filtered DNS:

  1. Agent installed on device
  2. DNS automatically configured
  3. No additional setup needed

Option 2: Network Level​

Configure your network to use Bastion DNS:

DNS Servers:

Primary:   103.247.36.36
Secondary: 103.247.37.37

Configure at:

  • Router/firewall
  • DHCP server
  • Active Directory DNS

Option 3: MDM Profile​

Deploy DNS configuration via MDM:

  1. Create DNS configuration profile
  2. Set Bastion DNS servers
  3. Deploy to managed devices

Encrypted DNS​

Support for encrypted DNS protocols:

ProtocolPortURL
DNS over HTTPS (DoH)443https://dns.bastion.io/dns-query
DNS over TLS (DoT)853dns.bastion.io

Filtering Policies​

Default Protection​

All accounts include:

  • Malware domains
  • Phishing sites
  • Command & control servers
  • Cryptomining sites

Content Categories​

Block content by category:

CategoryExamples
Adult ContentPornography, mature content
GamblingBetting, casinos
Social MediaFacebook, Twitter, TikTok
StreamingNetflix, YouTube
GamingOnline games, game platforms
ShoppingE-commerce sites

Creating Policies​

  1. Navigate to Web Browsing → DNS Filtering
  2. Click Create Policy
  3. Configure:
    • Policy name
    • Block categories
    • Custom allow/block lists
    • Target devices/groups
  4. Save and apply

Custom Rules​

Blocklist​

Block specific domains:

  1. Go to Custom Rules → Blocklist
  2. Click Add Domain
  3. Enter domain (e.g., example.com)
  4. Add description
  5. Save

Allowlist​

Allow specific domains (override blocks):

  1. Go to Custom Rules → Allowlist
  2. Click Add Domain
  3. Enter domain
  4. Add description
  5. Save

Wildcard Support​

Use wildcards for subdomain matching:

PatternMatches
*.example.comAll subdomains
example.comDomain only
*example*Contains "example"

Block Pages​

Custom Block Page​

Customize the page users see when blocked:

  • Company branding
  • Custom message
  • Request exception link
  • Redirect URL

Block Page Content​

Include:

  • Why the site is blocked
  • Category that triggered block
  • How to request access
  • IT contact information

Exception Requests​

User Requests​

Allow users to request exceptions:

  1. User visits blocked site
  2. Clicks "Request Access"
  3. Fills request form
  4. Admin reviews and approves/denies
  5. User notified of decision

Managing Requests​

  1. Go to Requests
  2. Review pending requests
  3. Approve or deny with comment
  4. Temporary or permanent exception

Reporting​

Dashboard Metrics​

MetricDescription
QueriesTotal DNS queries
BlockedQueries blocked
CategoriesBlocks by category
Top BlockedMost blocked domains

Query Logs​

View detailed query history:

  • Timestamp
  • Source device/user
  • Queried domain
  • Action (allowed/blocked)
  • Category matched

Reports​

Generate reports:

  • Daily/weekly summaries
  • Top blocked domains
  • Category breakdown
  • User activity (if enabled)

Integration​

SIEM Integration​

Forward DNS logs to SIEM:

  • Syslog format
  • CEF format
  • JSON format

Alerting​

Configure alerts for:

  • Malware domain access attempts
  • High-volume blocking
  • New threat detections
  • Policy violations

Best Practices​

Start with Threat Blocking

Enable threat categories first. Add content categories based on policy needs.

Test Before Deploying

Test policies on pilot group before organization-wide deployment.

Maintain Allowlists

Business-critical sites may get blocked. Maintain an allowlist for exceptions.

Review Regularly

Review blocked queries and exception requests regularly to refine policies.

Next Steps​

Browser Extension

Add browser-level protection

Infrastructure

Monitor your attack surface