Managed threat-domain sources
Matching phishing and malware-domain sources can prevent the configured endpoint from reaching a known risky hostname.
DNS THREAT PROTECTION
Stop a matching threat domain before the destination connection.
QueryWarden evaluates DNS requests against managed phishing and malware-domain protection alongside the account’s current policy. When the privacy setting permits evidence, teams and individuals can inspect the recorded decision without treating a DNS signal as a complete incident verdict.
Managed phishing and malware-domain blocking is available Explainable decisions and measured DNS incidents are available High-severity email alerts are evidence-based and privacy-aware
DNS decision pathIllustrative request
Device
Private DoH
QueryWarden policy
Allowed destination
Policy checked before connectionDecision evidence is reviewable when the profile retains it.
FROM SIGNAL TO RESPONSE
Block first, then investigate within the evidence boundary.
A protective decision is most useful when the operator can identify its source, the endpoint or scope involved when that data exists, and whether the event is an isolated block or part of a measured change in retained DNS activity.
Controls you can use and verify.
Each capability below reflects the current public product, with beta and compatibility limits called out separately.
A reason behind the decision
Eligible retained events can identify whether a custom rule, service policy, Safe Search, parental control, threat source, or resolver result decided the request.
Measured incident evidence
Incident records present detector window, threshold, occurrence count, limitations, privacy coverage, and representative retained evidence where available.
Scoped response paths
Managed organizations can use privacy-aware reports, scoped API access, signed webhooks, and SIEM export without making domain detail mandatory.
Protection settings and investigation evidence remain separate.
A profile controls which protections apply to its endpoints. A later Query Log explanation can show retained evidence for a particular request, but neither view turns a DNS signal into a complete malware or incident diagnosis.
Open full-size screenshot From matching domain to measured response
- 01Policy match
A configured endpoint requests a hostname matching an active managed source or customer rule.
- 02DNS block
The resolver returns the configured blocking result before the destination connection begins.
- 03Eligible evidence
If Full history is active and still retained, the event can show result, endpoint, and decision source.
- 04Human review
The operator considers repetition, scope, endpoint context, and other security evidence before changing policy.
HOW IT WORKS
From setup to an explainable DNS decision.
QueryWarden applies policy at the recursive DNS layer, before a supported client connects to the requested domain.
- 01
A protected endpoint requests a hostname
QueryWarden authenticates the private endpoint and resolves the profile and organization policy that apply to it.
- 02
Threat sources and policy are evaluated
Managed phishing and malware-domain sources are considered alongside custom rules and other applicable controls in the decision path.
- 03
The matching destination is blocked
The resolver returns the blocking response before the endpoint establishes its intended connection to that hostname.
- 04
Eligible evidence supports deliberate review
The Query log, explanation, incident workflow, alert, or integration contains only the detail permitted by retention and privacy settings.
CLEAR BOUNDARIES
A blocked DNS request is a security signal, not a final diagnosis
Threat-domain blocking reduces an important class of risk while leaving content, endpoint behavior, identity, and response ownership to other controls.
- QueryWarden cannot detect every newly registered, compromised, algorithmically generated, or same-domain malicious destination.
- DNS filtering does not inspect a downloaded file, browser DOM, email body, URL path, process behavior, or encrypted application content.
- A detector threshold or representative hostname is evidence that documented conditions were met; it is not proof that an endpoint was compromised.
- QueryWarden is an additional DNS security layer, not antivirus, EDR, a secure web gateway, a VPN, or a complete incident-response service.
WHO AND HOW
Technical basis and product evidence
Published and reviewed by QueryWarden Engineering, Digiport OÜ. First-party review against the current public QueryWarden product, its documented deployment constraints, and the primary sources listed on this page. This is not an independent audit, certification, approval, or endorsement.
Product screenshots are deterministic captures of the current interface using synthetic accounts, devices, and reserved .test domains. External sources explain protocols and industry guidance; they do not verify QueryWarden implementation claims.
Last reviewed . Product availability can change; dashboard capability labels remain the source of truth. Review our Security & Trust disclosure.Standards and public guidance
These primary sources support the general technical context. Citing them does not mean their publishers evaluated, approved, or endorsed QueryWarden.
- NISTSP 800-81 Rev. 3 — Secure DNS Deployment Guide (opens in a new tab)Current deployment guidance for DNS security, encrypted DNS, policy enforcement, and DNS evidence.
- UK NCSCProtective DNS for the private sector (opens in a new tab)Explains policy-based recursive DNS, deployment choices, logging, and investigation use cases.
- CISA#StopRansomware Guide (opens in a new tab)Places protective DNS within a layered response to ransomware, phishing, malware, and related threats.
What to know before you change DNS.
Does DNS threat protection block every phishing site?
No. It can stop a hostname that matches current managed sources or policy, but no DNS service can guarantee detection of every new, compromised, or same-host phishing page.
What does an incident in QueryWarden mean?
It means a documented detector threshold was met in the retained DNS evidence available for that tenant and window. Review its limitation and privacy coverage before drawing a conclusion about compromise.
Can DNS filtering stop zero-day attacks?
It cannot guarantee that. DNS filtering can reduce exposure when a hostname matches an active managed source or customer policy, including after threat intelligence is updated. It does not detect an unknown exploit, inspect code or files, or stop malicious content served from an allowed hostname, so patching, endpoint, browser, email, identity, and other network controls still matter.
START WITH THE AVAILABLE FREE PLAN
Put managed threat-domain blocking in the first DNS path.
Start with one protected endpoint, generate fresh traffic, and use retained evidence only within the profile’s privacy boundary.