A protective DNS service sits between clients and upstream resolvers, checking each query against threat intelligence, reputation, and analytics. Malicious lookups return a block page, a safe redirect, or no answer at all; everything else resolves normally. It is straightforward to deploy because it works at the resolution layer, below applications.
Key points
First-line filteringIt blocks connections before payloads download — valuable against commodity malware and phishing at scale, at low operational cost.
Blocked-query visibilityLog blocked queries for hunting and triage; a blocked lookup often reveals the compromised host or clicked link behind it.
Important limitationIt only sees DNS-based lookups. Direct-IP connections, non-DNS channels, DNS over encrypted transports that bypass the resolver, and domains too new or too obscure for the threat intelligence behind it all pass through.