Remote SupportWhy DNS Security Matters
DNS is the phonebook of the internet. Every web request, email send, SaaS login, and software update starts with a DNS lookup. Attackers know this. DNS is also one of the most overlooked attack surfaces because it mostly just works.
Compromising DNS lets attackers redirect traffic, intercept logins, silently steal data, or kill a business in minutes. DNS filtering also stops more than 90 percent of malware at the lookup stage, before it reaches the endpoint.
Australian context
The ASD ISM Guidelines for Networking (June 2025) require a protective DNS service to block access to known malicious domains. The ACSC's Annual Cyber Threat Report 2024-2025 recorded 138 ransomware incidents and a cybercrime report every six minutes. Hardening DNS is one of the cheapest ways to block the lookup that starts most of those attacks.
How DNS Attacks Work
DNS cache poisoning
Attacker injects a false record into a resolver cache. Users are silently redirected to a malicious site.
DNS hijacking
Attacker changes DNS at the registrar or router. Every user on that network gets sent to attacker infrastructure.
DNS tunnelling
Malware encodes stolen data into DNS queries to exfiltrate past firewalls. Almost always unlogged.
Typosquatting
Fake domains like micros0ft.com or realbyres.au. Used for phishing and malware drops.
Fast flux
Attackers rapidly rotate IPs on a domain to evade takedown and blocklists.
Registrar compromise
If someone takes over your domain account, they can point MX, A, and NS records anywhere. Catastrophic.
DNSSEC (DNS Security Extensions)
DNSSEC cryptographically signs DNS responses so resolvers can verify the record has not been tampered with in transit. It protects against cache poisoning and spoofing at the authoritative layer.
What DNSSEC does
- Signs authoritative DNS records with public-key cryptography
- Lets resolvers verify responses were not modified
- Prevents cache poisoning and man-in-the-middle DNS attacks
What DNSSEC does NOT do
- Does not encrypt DNS queries (that is DoH / DoT)
- Does not protect against phishing or malicious domains
- Does not prevent registrar compromise
Enable DNSSEC at your domain registrar and ensure your authoritative DNS provider supports it. Cloudflare, Route 53, Azure DNS, and Google Cloud DNS all support DNSSEC signing.
DNS Filtering (Protective DNS)
DNS filtering blocks lookups to known-malicious, phishing, malware, and command-and-control domains. It is the single highest-ROI security control most SMBs have never turned on. ACSC lists Protective DNS in the Essential Eight-adjacent recommendations.
What it blocks
- Phishing domains
- Malware command-and-control
- Newly registered domains (24-72 hours old)
- Typosquatted lookalikes
- Cryptomining pools
- Categories (adult, gambling, proxies)
Why it works
- Blocks at the lookup, before any bytes transfer
- Works on all devices, even guests and IoT
- No agent required (unlike EDR)
- Low latency, cheap to run
- Full audit log of attempted lookups
Recommended providers:
- Cisco Umbrella: enterprise-grade, deep reporting, higher cost
- DNSFilter: best value for SMBs, AI-driven categorisation
- Cloudflare Gateway: strong free tier, integrates with Zero Trust
- Quad9: free public resolver (9.9.9.9), threat-blocking enabled by default
- NextDNS: flexible, developer-friendly, privacy-focused
Public DNS Servers Compared
Most home networks and many small businesses still use whatever DNS the ISP hands out. Switching to a public resolver is one of the cheapest security and performance upgrades available. Here is how the main free options stack up.
Cloudflare 1.1.1.1, 1.1.1.2 and 1.1.1.3
Cloudflare runs the most widely used public DNS service in 2026. Three tiers from the same network, all free, all fast over IPv4, IPv6, DoH and DoT.
1.1.1.1
Standard, no filtering
Pure speed and privacy. Resolves anything, including malicious sites. Best when you already run endpoint protection.
1.1.1.2
Malware filtering
Same speed as 1.1.1.1, plus blocks domains tied to malware, phishing and command-and-control. Bad lookups return 0.0.0.0 and quietly fail.
1.1.1.3
Malware and adult content
Everything 1.1.1.2 blocks, plus adult content. Useful for family devices or any network where adult content should be off limits.
Quad9, Google, OpenDNS and others
Quad9 (9.9.9.9)
Non-profit Swiss-based service. Blocks malicious domains using threat intelligence from over a dozen sources including IBM X-Force. Strong privacy stance, no monetisation of query data.
Google Public DNS (8.8.8.8 / 8.8.4.4)
Fast, reliable, globally distributed. No filtering of any kind. Google says it does not use DNS data for ads. Good fallback DNS, less ideal as primary for privacy-conscious users.
OpenDNS / Cisco Umbrella (208.67.222.222)
Pioneered consumer DNS filtering. Free OpenDNS Home and FamilyShield variants block phishing and adult content. Cisco Umbrella is the paid business version.
NextDNS
Modern, configurable, free tier available. Custom blocklists, analytics, and Australian endpoints. Popular with technical users and small businesses that want filtering control without enterprise pricing.
AdGuard DNS (94.140.14.14)
Free public DNS with ad and tracker blocking on top of malware filtering. Useful at home, less suitable for business networks where ad blocking can break legitimate marketing tools.
CleanBrowsing
Family, adult and security filters across three free tiers. Australian users sometimes see slightly higher latency than Cloudflare or Google, but the filtering is solid.
| Provider | Primary IP | Malware filter | Adult filter | Cost |
|---|---|---|---|---|
| Cloudflare | 1.1.1.1 | No | No | Free |
| Cloudflare Malware | 1.1.1.2 | Yes | No | Free |
| Cloudflare Family | 1.1.1.3 | Yes | Yes | Free |
| Quad9 | 9.9.9.9 | Yes | No | Free |
| Google Public DNS | 8.8.8.8 | No | No | Free |
| OpenDNS Home | 208.67.222.222 | Yes | Optional | Free |
| Cisco Umbrella | Various | Yes | Configurable | Paid |
| NextDNS | Various | Configurable | Configurable | Free / paid |
| AdGuard DNS | 94.140.14.14 | Yes | Optional | Free |
For most home users, Cloudflare 1.1.1.2 is the sensible default. For business, the free public services are a fine starting point but rarely the right end state. Business-grade protective DNS adds reporting, category-based policy, allow and block lists, and integration with identity. The ACSC publishes Protective DNS guidance for government and business at cyber.gov.au protective DNS.
DoH and DoT: Encrypted DNS
DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) encrypt DNS queries between the client and the resolver. This prevents snooping, on-path modification, and hides lookups from anyone watching the network.
Good: Encrypted DNS to your controlled resolver
Configure clients (or the whole fleet via Intune / Group Policy) to use DoH to your filtering provider. Encryption plus filtering.
Bad: Browsers bypassing your DNS
Chrome, Firefox, and Edge can silently use their own DoH to Cloudflare or Google, bypassing corporate DNS filtering. Disable browser DoH and enforce fleet-wide.
Split-Horizon DNS
Split-horizon DNS serves different answers to internal vs external clients for the same hostname. A staff member on the office network might resolve intranet.example.com to an internal 10.x IP, while an external lookup returns the public load balancer (or nothing at all).
When to use split-horizon
- Internal services should not leak to public DNS (intranet, fileserver, Git)
- Hybrid workloads where internal users need direct IPs but external users go via WAF
- Keeping internal topology private from attackers enumerating your domain
Most Australian SMBs do not run split-horizon themselves. If you do need it, handle it via Azure Private DNS, AWS Route 53 private hosted zones, or an on-prem Windows DNS server (with conditional forwarders).
Our Recommended DNS Stack
Domain registrar
Use an auDA-accredited Australian tier-1 registrar for .au domains. Synergy Wholesale and VentraIP are the two we trust most for business: Australian-owned, accredited, 24/7 Australian support, and proper account security. Cloudflare Registrar is the strongest option for gTLDs (.com, .io, .net) thanks to at-cost pricing, registry lock, and tight MFA. Avoid resellers, GoDaddy, and bargain-bin registrars for anything that matters. Lock the domain. Enforce MFA on every admin. Keep registrar credentials separate from day-to-day staff accounts.
Authoritative DNS
Cloudflare, Route 53, or Azure DNS. DNSSEC enabled. Separate from the registrar where possible.
Recursive DNS (internal)
DNS filtering provider (DNSFilter, Umbrella, Quad9). DoH or DoT to the resolver.
Endpoint config
Enforce resolver via Intune / Group Policy. Disable browser-level DoH. Block port 53 and 853 to anywhere except the chosen resolver.
Monitoring
Alert on unusual lookup patterns, high-volume NXDOMAIN, DNS tunnelling signals.
Common Mistakes
Using the ISP resolver
No filtering, no logging, no threat intelligence. Never use your ISP resolver for a business.
No MFA on the registrar
Registrar takeover is catastrophic. MFA and registrar lock must be enabled.
Registrar and DNS in the same account
If one is compromised, both go. Keep them separate when possible.
Hardcoded 8.8.8.8 in the router
Bypasses every filtering tool you just paid for. Set the resolver via DHCP to your filter.
Ignoring DNS in incident response
DNS logs are one of the fastest ways to trace what a compromised endpoint did. Most businesses have no DNS logs.
Letting browsers use their own DoH
Chrome and Firefox will silently bypass corporate filtering. Must be disabled via policy.
No registrar lock on .au domains
auDA-accredited registrars support registry lock and Domain Lock to prevent unauthorised transfers and DNS changes. Turn it on. Pair with MFA on the registrar account.
Forgetting CAA records
A CAA DNS record limits which Certificate Authorities can issue SSL certs for your domain. Without it, an attacker who compromises DNS can issue valid certs and impersonate you.
Harden Your DNS
We deploy DNS filtering, DNSSEC, and registrar hardening as part of our managed security services. Start with a free DNS and domain audit.