DNS security

DNS is the internet's phone book. Make sure nobody can rewrite yours.

Every website visit and every email starts with a DNS lookup. Filter those lookups and you block a lot of phishing and malware before it loads. Lock down your own domain's DNS and nobody can redirect your website or email. Here is how to do both, which public resolvers actually filter, and a live check of your domain.

Guidance from ASD and NSA/CISA on protective DNS. Checked 30 October 2026.

Have us check your DNS Check your domain 07 3114 2808

Public resolvers compared
Protective DNS explained
Live domain check

Reviewed by Blake Bath, General Manager, on 30 October 2026.

An IT technician points at a laptop while explaining something to a bakery owner in a flour-dusted apron, with the office router on a shelf behind them. — **The biggest single risk**Your domain registrar account. Whoever controls it controls your website and email.

How DNS gets abused

Five ways DNS gets used against a business.

Two are about your staff's lookups. Three are about your own domain.

Registrar takeover

Someone gets into your domain registrar account and points your website and email anywhere they like.

MFA on the registrar
Domain lock
Know who has the login

DNS health check

How well protected is your domain's DNS?

Enter your domain. We check DNSSEC, certificate authority restrictions, mail servers and DMARC from public records, in your browser.

Your result

How well protected is your domain's DNS?

Checks DNSSEC, certificate controls, mail and DMARC in a few seconds.

Get it fixed

Public resolvers

Free public DNS servers compared.

Resolver	Address	Blocks malware	Blocks adult content
Cloudflare	1.1.1.1	No	No
Cloudflare for Families, security	1.1.1.2	Yes	No
Cloudflare for Families, family	1.1.1.3	Yes	Yes
Quad9	9.9.9.9	Yes	No
Google Public DNS	8.8.8.8	No	No
Your internet provider's DNS	Varies	Usually not	Usually not

All are free. Quad9 is run by a Swiss non-profit foundation. Free resolvers block known bad domains but give you no reporting, no rules of your own and no protection once a laptop leaves the office.

For a business

What protective DNS adds for a business.

ASD and the US NSA and CISA all recommend protective DNS: a resolver that checks every lookup against threat intelligence and blocks known malicious domains. It stops a lot of phishing pages and malware callbacks without anyone needing to spot them.

Business services go further than the free resolvers. They add category blocking, your own allow and block lists, reports you can use in an incident, and an agent on each laptop so the protection follows staff home and onto hotel Wi-Fi.

Point everything at itHand the resolver out through the router or DHCP, and set it on managed devices through Intune.
Block the way around itOnly allow DNS (port 53) and DNS over TLS (port 853) out to your chosen resolver.
Control browser encrypted DNSSet Chrome, Edge and Firefox to use your resolver, or turn their own DNS over HTTPS off by policy.
Keep the logsDNS logs show what a compromised device tried to reach. Keep them long enough to investigate.

Your own domain

Lock down your own domain.

MFA on the registrar accountThe most important control on this page. Use an app or passkey, not SMS.
Domain lockTurn on transfer lock, and registry lock if your registrar offers it, so changes need extra steps.
Know who holds the loginNot a former web developer or an ex-employee's personal email.
Turn on DNSSEC.au domains support it. Make sure whoever hosts your DNS manages it if you move providers.
Add CAA recordsList the certificate authorities you use, so others refuse to issue certificates for your domain.
SPF, DKIM and DMARCStop others sending email as your domain. DMARC at quarantine or reject is the goal.

Our view

Start with the registrar, then filter the lookups.

Check the domain registrar first: who has the login, whether it has MFA, and whether the domain is locked. Make sure it is not sitting in a former web developer's account or a personal email nobody can reach any more.

Then put protective DNS on the network and on each device, and set browsers on managed machines to use it, so their own encrypted DNS cannot skip the filtering.

In order

A DNS security setup in five steps.

Step 1Secure the registrar
MFA, domain lock and a business-owned login.
Step 2Harden the domain
DNSSEC, CAA, SPF, DKIM and DMARC.
Step 3Filter lookups
Protective DNS on the network and every device.
Step 4Close the gaps
Block other DNS servers and browser DNS over HTTPS.
Step 5Keep logs
Long enough to investigate an incident.

Related guides

DNS is one layer. These are the ones around it.

Email, devices and network security that work with good DNS.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about DNS security.

Which DNS server should a small business use?

Not the one your internet provider hands out. At minimum, use a free filtering resolver such as Quad9 (9.9.9.9) or Cloudflare's malware-blocking 1.1.1.2. For a business, a paid protective DNS service adds reporting, category rules and per-user policy that works off the office network too.

What is the difference between 1.1.1.1, 1.1.1.2 and 1.1.1.3?

All three are Cloudflare. 1.1.1.1 resolves everything with no filtering. 1.1.1.2 also blocks known malware and phishing domains. 1.1.1.3 blocks malware and adult content.

Is Google's 8.8.8.8 secure?

It is fast and reliable, but it does not filter anything. It will happily resolve a phishing site. It is fine as a fallback, not as your protection.

What is DNSSEC and do we need it?

DNSSEC signs your domain's DNS records so resolvers can check the answers are genuine and have not been tampered with. .au domains support it. It is worth turning on at your DNS host, as long as someone manages it when you change providers.

What does a CAA record do?

It lists which certificate authorities may issue TLS certificates for your domain. Other authorities must refuse. It is a cheap extra control, but it does not help if an attacker controls your DNS, because they can change the CAA record too.

Should we block browser DNS over HTTPS?

On managed business devices, set the browser to use your company resolver, or turn its own encrypted DNS off by policy. Otherwise Chrome, Edge or Firefox can send lookups to their own provider and skip your filtering.

Next step