Tutorials · Security Operations

How to Block Malware and Phishing Domains With DNS Filtering

Most malware and phishing needs DNS to reach its servers. Filter DNS for every device on the network with your own resolver and blocklists, and stop users bypassing it.

Beginner12 min6 steps

Before you start

A small Linux server or edge server with Docker
Admin access to DHCP and the gateway firewall

Step by step

Run a filtering resolver

AdGuard Home and Pi-hole are free, self-hosted DNS filters. Example with AdGuard Home in Docker:

docker run -d --name dnsfilter --restart unless-stopped \
  -p 53:53/tcp -p 53:53/udp -p 3000:3000/tcp \
  -v /opt/dnsfilter/work:/opt/adguardhome/work \
  -v /opt/dnsfilter/conf:/opt/adguardhome/conf \
  adguard/adguardhome

Complete the setup
Open http://<server>:3000, set an admin password, choose upstream resolvers and enable malware and phishing blocklists.
Point clients to it
Set the filter's IP as the DNS server in every DHCP scope. Keep a second filter server for redundancy.
Stop DNS bypass
Block outbound DNS (UDP/TCP 53) from user VLANs except from your DNS servers, and block known public DNS-over-HTTPS endpoints where policy allows.
Test
Query a known test domain from your blocklist and confirm it is blocked, while normal sites resolve.
```
dig @10.1.10.5 www.example.com
dig @10.1.10.5 <blocked-test-domain>
```
Review the logs
Blocked queries show infected or misbehaving devices. Investigate repeated blocks from the same host.

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.

Pro tips

Allow-list business domains that are blocked by mistake, and document why.
Log retention may contain personal data: set retention according to your policy.

FAQ

Frequently asked questions

Does DNS filtering replace antivirus?

No. It is an extra layer that blocks many threats early, but endpoint protection is still needed.

Keep learning

Related guides

Troubleshoot DNS with dig

Write firewall rules that protect

Run Docker on a NavEDGE edge server

How to Set Up a WireGuard VPN Server for Remote Access

WireGuard is a fast, modern VPN with a small, auditable code base. Build a WireGuard server on Linux, add users with their own keys and route them only to the networks they need.

How to Scan Your Network for Vulnerabilities With Nmap and OpenVAS

Find open ports, outdated services and known vulnerabilities before attackers do. Discover hosts with Nmap, then run authenticated vulnerability scans with Greenbone OpenVAS and fix what matters first.

How to Build a Free SIEM With Wazuh for Network and Server Logs

A SIEM collects logs from servers, firewalls and switches in one place and alerts on attacks. Install Wazuh, add agents and syslog sources, and tune the first alerts.

Stuck on a step?

Ask Navijin technical support or an authorised partner for help with your configuration.

Contact technical support All tutorials