CyberFOX DNS Filtering

At the DNS layer, malicious sites, phishing domains, and malware are blocked before a request even resolves to an IP address. This means that malware, ransomware, and phishing domains are automatically blocked across all managed endpoints. Because the block is at resolution, a device never actually connects to the malicious domain in the first place.

The platform uses AI-based pattern detection to identify and block threats. This includes emerging attack patterns that might not have explicit block list entries yet. The detection runs continuously in the background to identify malicious domain behavior based on suspicious patterns. It helps catch newer threats that haven't been flagged yet.

Admins can approve or restrict DoH settings on a per-device basis. This closes a common loophole: users or apps setting up their own encrypted DNS resolver to route around the filter entirely. Instead, IT teams can manage how encrypted DNS queries are processed at the endpoint level.

The reports page breaks down permitted and blocked DNS activity by total query volume, alongside record type, and upstream server. It also shows which domains and locations are generating the most traffic. Beyond that, the query log gives a near-real-time list of individual DNS lookups. These can be filtered—by domain, location, or outcome—so you can trace a specific request. Anything on either screen can also be exported to CSV.

Beyond CyberFOX's built-in filtering categories, admins can build their own domain groups. Admins can configure these categories to allow, block, proxy, or hold domains for review and attach them to multiple policies at once. This is useful for responding quickly to a newly discovered phishing domain for every client at once. Domain overrides handle the opposite case: a single site that needs to stay reachable despite what the broader policy would otherwise do.