Why your office needs DNS filtering

What DNS actually does every time someone clicks a link

Whenever a computer, phone or VoIP phone in your office connects to anything on the internet—whether it is your bank, SARS eFiling, Microsoft 365, WhatsApp Web, or a link inside an email—it has to look up the numeric internet address (IP address) for that domain name first. That address-book lookup is called DNS (Domain Name System).

By default, your office router sends every DNS lookup to your fibre or LTE provider's standard resolver. A standard resolver has only one job: return the address as fast as possible, no matter how dangerous the website is or what is hidden inside the lookup name.

Why email spam filters and antivirus leave a gap

Most offices rely on the spam filter built into their email and the standard antivirus on their Windows PCs. Both are essential, and DNS filtering does not replace them—but in a real South African office, three gaps remain wide open:

First, staff don't only click links in work email. They click links in WhatsApp Web, SMS messages on phones connected to the office Wi-Fi, personal Gmail tabs, and PDF documents downloaded from portals. Your work email spam filter never sees those links.

Second, many office devices cannot run antivirus at all—or have nobody managing it. Reception PCs, contractors' laptops, staff smartphones on the office Wi-Fi, and call-centre thin clients all share the same office internet connection.

Third, standard firewalls block incoming connections from outside, but they almost always allow outbound DNS lookups (port 53) out to the internet because nothing works without DNS. Malware authors know this, which is why data-stealing malware often chops stolen information into pieces and hides it inside outbound DNS lookup names.

Two jobs in one router setting: blocking bad sites and catching data leaving

When you change the DNS setting on your office router to point at a protective DNS service like ZDNS, every device using the office internet sends its lookups through two checks before any connection is made:

1. Blocking known phishing and malware sites: If a staff member clicks a link to a domain on Google Web Risk's list of suspected phishing, malware or unwanted-software sites, the resolver answers 'does not exist' (NXDOMAIN). The browser never connects to the server, so the fake login page or malware download never loads.

2. Inspecting the lookup itself for stolen data: Even if an attacker registered a brand-new domain ten minutes ago that is not on any blocklist in the world, data-stealing malware still has to embed the stolen data inside the lookup name (for example, `4532xxxxxxxx1111.sync-cdn.example` or `850101xxxx086.api-check.example`). ZDNS inspects every lookup name for 16-digit payment card numbers (verified with the Luhn checksum banks use), 13-digit South African ID numbers (verified with the official SA ID check digit), SA mobile numbers, and high-entropy scrambled strings. When it spots one, it blocks the lookup so the data never reaches the attacker.

Why starting in shadow mode matters for a busy office

The biggest reason small businesses and call centres put off network security is fear of breaking something during working hours—nobody wants a security tool that suddenly stops the VoIP dialler, accounting package or banking portal on a Monday morning.

That is why ZDNS starts every new office in shadow mode for about 7 days. During that first week, every lookup is checked and any suspicious lookup is recorded on your dashboard, but nothing is blocked. You (or your IT technician) can review what was flagged, whitelist any legitimate business tool with one click, and only switch active blocking on once you are completely happy.

What DNS filtering can and cannot do

Under Section 19 of POPIA, businesses are expected to layer reasonable technical and organisational safeguards rather than relying on a single silver bullet. Being honest about what each layer does is part of good security:

DNS filtering protects devices while they are connected to your registered office internet connection, and it only sees domain-name lookups—never the contents of your emails, web pages, medical files or accounting documents. It will not stop an attacker who sends stolen data out over an ordinary encrypted HTTPS upload to a reputable cloud storage site, and it does not replace backups, antivirus or staff vigilance. What it gives you, in ten minutes and with zero software to install on staff computers, is a safety net across the whole office router and a clear weekly record of what tried to leave your network.