# What is Protective DNS?

> Protective DNS is a resolver service that blocks lookups for domains known or assessed to be malicious — stopping connections to phishing, malware, and command-and-control infrastructure before they start.

- Canonical URL: https://yellowcube.eu/glossary/protective-dns/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

A protective DNS service sits between clients and upstream resolvers, checking each query against threat intelligence, reputation, and analytics. Malicious lookups return a block page, a safe redirect, or no answer at all; everything else resolves normally. It is straightforward to deploy because it works at the resolution layer, below applications.

### Key points

- **First-line filtering:** It blocks connections before payloads download — valuable against commodity malware and phishing at scale, at low operational cost.
- **Blocked-query visibility:** Log blocked queries for hunting and triage; a blocked lookup often reveals the compromised host or clicked link behind it.
- **Important limitation:** It only sees DNS-based lookups. Direct-IP connections, non-DNS channels, DNS over encrypted transports that bypass the resolver, and domains too new or too obscure for the threat intelligence behind it all pass through.

### Related terms

[Domain Name System (DNS) security](<https://yellowcube.eu/glossary/domain-name-system-security/>) · [Domain Name System Security Extensions (DNSSEC)](<https://yellowcube.eu/glossary/domain-name-system-security-extensions/>) · [Threat intelligence feed](<https://yellowcube.eu/glossary/threat-intelligence-feed/>) · [Command and control (C2)](<https://yellowcube.eu/glossary/command-and-control/>) · [Secure web gateway (SWG)](<https://yellowcube.eu/glossary/secure-web-gateway/>)

### Sources

[NSA & CISA, Selecting a Protective DNS Service](https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-062a) · [NIST SP 800-81 Rev. 3, Secure Domain Name System Deployment Guide](https://csrc.nist.gov/pubs/sp/800/81/r3/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.