WatchGuard DNSWatch explained

What DNSWatch does

DNSWatch is one of the security services that run on a WatchGuard Firebox. WatchGuard describes it as a service that blocks malicious DNS requests, redirects users to a secure, informative page, and promotes good security practice to prevent phishing attacks and reduce malware infections.

In WatchGuard's documentation it is a cloud-based subscription service managed in WatchGuard Cloud. When DNSWatch is enabled, the Firebox uses DNSWatch as the DNS resolver for protected networks. If a requested domain is a known threat, DNSWatch returns its blackhole content and the user sees a security block page instead of the site; if the domain is in a content category your policy filters, the user sees a content filtering block page. Otherwise the lookup resolves normally.

Because it sits on the firewall, DNSWatch protects every device on the network, including printers, guest devices and IoT kit that cannot run a security agent. That is the strength of a firewall-based DNS service; the limitation is that it only protects devices while they are behind a protected Firebox. For the general idea, see DNS-layer security.

How DNSWatch works on a Firebox

1. Licence: a DNSWatch licence is added to the Firebox feature key, normally as part of the Prime or Total Security Suite.
2. Registration: when DNSWatch is enabled, the Firebox registers with the service and receives the addresses of two DNSWatch DNS servers and a blackhole server.
3. Usage enforcement: with usage enforcement on, the Firebox redirects all outbound DNS requests on port 53 to DNSWatch, even when a device asks for a specific public DNS server. WatchGuard says it is enabled by default on cloud-managed Fireboxes and optional on locally managed ones.
4. Checks: DNSWatch checks each domain against its threat feeds and, if a content filtering policy is assigned, against the content categories that policy filters.
5. Block page: HTTP and HTTPS requests to known threats go to a customisable security block page, and filtered content goes to a customisable content filtering block page.

Two practical points follow from this. Usage enforcement is what stops devices simply using a different resolver, so it should be on. And WatchGuard's documentation describes redirecting traditional DNS on port 53; lookups that a browser sends over DNS over HTTPS are a separate problem that needs its own controls. Our page on blocking DNS over HTTPS explains the NCSC's advice.

A block page for an HTTPS site can show a certificate warning, because the browser expected the real site's certificate. The NCSC notes the same trade-off for protective DNS in general; see DNS sinkhole for the block page vs sinkhole vs NXDOMAIN choice.

Which WatchGuard subscriptions include DNSWatch

The Prime Security Suite sits between Basic and Total on newer appliances and adds APT Blocker sandboxing, DNSWatch and Shadow AI visibility. The Total Security Suite adds DNSWatch alongside its other services. If your Firebox is on Standard Support or Basic, moving to a higher suite at renewal is how you gain DNSWatch; send us the serial number and we can confirm what your appliance supports. Licensing detail is on our WatchGuard Firebox licensing page.

DNSWatch test, login and servers

Three quick answers to things people search for:

How to test DNSWatch. WatchGuard's troubleshooting guide says the domain test.strongarm.io is blocked by DNSWatch by default, so browsing to it from a device behind the Firebox should show the DNSWatch block page. For a DNS-level check, the guide uses nslookup: a lookup sent to the Firebox's trusted interface should return the DNSWatch blackhole address if the Firebox is forwarding to DNSWatch, and a lookup sent directly to a public resolver should also return the blackhole address if usage enforcement is working. Our DNS security test guide covers broader checks, including encrypted DNS and off-site devices.

DNSWatch login. DNSWatch is managed in WatchGuard Cloud, so administrators sign in to their WatchGuard Cloud account to see blocked requests, manage policies and customise block pages. We do not run a separate portal.

DNSWatch servers. The Firebox learns the DNSWatch DNS server and blackhole server addresses when it registers with the service, so you do not configure them by hand on each device. Devices keep using the Firebox (or your internal DNS forwarding to it) as their resolver.

What about devices off the network?

DNSWatch on a Firebox protects devices while they are behind that Firebox. Laptops at home, on public Wi-Fi or on mobile data need something on the device itself.

WatchGuard's current answer for remote users is WatchGuard FireCloud, its cloud-delivered firewall, secure web gateway and ZTNA service, covered on our WatchGuard FireCloud page. Other options include a standalone DNS service with a roaming client, or a DNS add-on in your endpoint protection. Ask us about off-site options and we will match them to what you already run; our DNS roaming client guide explains how the different agents work.

DNSWatch alongside other Firebox services

DNSWatch is one layer among several on a Firebox, and it helps to know what each one covers:

The value of DNSWatch is that it stops many threats at the cheapest possible point, the lookup, and it covers applications and ports that do not pass through the web filter. It does not replace the other services, and they do not replace it.

DNS data from DNSWatch is also useful evidence. A device that keeps asking for a known command-and-control domain is a strong sign of infection, which is why the NCSC recommends reviewing blocked DNS requests; see DNS security best practices.

Who DNSWatch suits

DNSWatch suits organisations that already standardise on WatchGuard Fireboxes, particularly:

• offices and branches where most devices stay on site
• networks with guest Wi-Fi, printers, cameras and IoT devices that cannot run an agent
• businesses renewing a Firebox and deciding between the Basic, Prime and Total suites
• teams that want firewall, DNS filtering and other WatchGuard services in WatchGuard Cloud

If most of your people work away from the office, pair DNSWatch with an off-site option or look at a standalone service on our DNS security solutions page.

We can review your current Firebox subscriptions, enable and tune DNSWatch, set content categories and block pages, and check that usage enforcement and encrypted DNS controls leave no easy bypass. Contact us and ask us for a quote.