In short
Protective DNS (PDNS) is a recursive DNS resolver that refuses to resolve domains known to be malicious, so devices cannot reach malware, phishing or command-and-control sites. Central government, other eligible organisations and UK schools can use the NCSC's free PDNS; everyone else needs a commercial protective DNS service, chosen against the NCSC's private-sector criteria.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What protective DNS is
Every time a laptop, phone or server opens a website, an app or a background connection, it first asks a DNS resolver to turn a name such as www.example.co.uk into an IP address. The NCSC notes that DNS is often called the address book of the internet. Ordinary resolvers answer every question they are asked. A protective DNS resolver checks each question against policy first.
The NCSC describes protective DNS as a recursive DNS resolver that prevents access to domains known to be malicious. In its guidance for the private sector it explains that typically both the domain name requested and the IP address returned are checked against a deny list, and access is prevented if there is a match. Some providers also try to block programmatically generated domain names, which malware uses to get round deny lists (see DNS attacks for how these domain generation algorithms work).
According to the NCSC, protective DNS prevents access to:
- domains distributing malware
- command and control (C2) domains used to control malware that is already on a device
- domains used in phishing attacks, including those used for fraud
Because the check happens at the lookup, it works for every application and every port on the device, not just the web browser, and it happens before any connection to the malicious server is made. That is why protective DNS is usually described as a first layer of defence rather than the whole answer. Our guides to what DNS security is and DNS-layer security explain where it sits alongside firewalls, web proxies and endpoint protection.
The NCSC also points to a secondary benefit: the record of blocked requests. A device that keeps trying to reach a known command-and-control domain is a strong sign of an infection, and those blocks are valuable evidence when fed into a security information and event management (SIEM) tool.
NCSC PDNS or a commercial protective DNS service?
In the UK the phrase "protective DNS" often means one specific service: the NCSC's own NCSC PDNS, which is free, centrally funded and mandated by the Cabinet Office for central government departments. It is also available to other organisations that meet the NCSC's eligibility criteria and, since the NCSC's October 2024 announcement, to all UK schools through PDNS for Schools.
Most private sector organisations are not eligible, so they buy protective DNS from a commercial provider. The NCSC publishes separate guidance for them, and it is clear on one point: if your organisation qualifies for the NCSC's PDNS, a commercially procured service should not be considered a substitute.
| NCSC PDNS | Commercial protective DNS | |
|---|---|---|
| Who can use it | Central government (mandated) and other organisations the NCSC deems eligible, including UK schools | Any organisation |
| Cost | Free, centrally funded by the NCSC | Paid subscription; ask us for a quote |
| What it blocks | Domains known to be malicious: malware, ransomware, phishing, spyware and malware communication | Security categories plus, with most services, content categories you choose |
| Policy control | Run by the NCSC to its own rules | Your policies by network, group or user, with your own allow and block lists |
| Off-site devices | PDNS Roaming for Windows, macOS and iOS | Roaming clients or agents, depending on the provider |
| Reporting | Dashboards, logs and SIEM connectors for Microsoft Sentinel and Splunk | Dashboards, reports, APIs and log export, varying by provider and plan |
The two are not quite the same kind of product. The NCSC describes its PDNS as blocking domains known to be malicious; it does not describe content categories you can choose or per-user policies. For schools, the NCSC says PDNS for Schools complements, but does not replace, the safeguarding filtering schools should already have in place, so they still need filtering that meets the Department for Education's standards. Our guide to web filtering for schools covers that side.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
How to choose a protective DNS service: the NCSC checklist
The NCSC's guidance on protective DNS for the private sector is the most useful buyer's checklist we know of for UK organisations. It also cites guidance on selecting a PDNS service published by CISA and the NSA in the US. This table turns the NCSC's points into questions to put to any provider, including us.
| What the NCSC asks for | Questions to ask the provider |
|---|---|
| A trusted provider whose deny lists and policies are regularly updated from threat intelligence feeds | Where does your threat intelligence come from? How often are block lists updated? |
| A web interface for administration and an overview of DNS security analysis | Can we see blocked requests, top domains and affected devices in one dashboard? |
| Logs of blocked requests through the interface and an API, easy to integrate with existing security systems | Can logs go to our SIEM? Is there an API? Is log export included in our plan? |
| Allow lists that administrators can update through a user interface | How quickly can we allow a wrongly blocked domain, and who can do it? |
| A choice of response to blocked domains: block page, sinkhole or NXDOMAIN | What does a user see when a domain is blocked? Can it differ by network? |
| Support for any DNS protocol extensions you use, including DNSSEC and DNS encryption protocols | Do you validate DNSSEC? Do you support DNS over HTTPS or DNS over TLS? |
| Flexibility for complex and hybrid networks, with different policies for different networks and users | Can we set separate policies for staff, guests and sites? How does it work with internal DNS? |
| A lightweight client so roaming and home devices resolve DNS through the protective resolvers | Which operating systems does your roaming client support? How is it deployed? |
| Ways to stop users and applications using other resolvers | How do you handle browsers and apps that use their own encrypted DNS? |
| Clear commitments on how your DNS data is used and protected | Where is our query data stored, for how long, and who can see it? |
| Protection against DNS spoofing and hijacking of the resolver itself | How do you secure your resolvers? Do you support DNSSEC? |
| A service level agreement and appropriate failover | What availability do you commit to, and what happens if a resolver fails? |
On privacy, the NCSC makes a point worth repeating: a protective DNS service can see every DNS query your network makes, so you may want a provider that makes commitments about how it uses and protects that data, and that may not be possible with freely available services. Our page on free DNS protection looks at that trade-off.
DNS firewalls and Response Policy Zones (RPZ)
"DNS firewall" is another name you will see for the same idea. It usually refers to Response Policy Zones (RPZ): a method that lets a resolver administrator overlay their own policy on top of the global DNS and give alternative answers to chosen queries. RPZ rules can match a bad host or domain name, the IP address an answer points to, or a name server that only hosts malicious domains, and either block the lookup or redirect it to a "walled garden". ISC's BIND resolver is the reference implementation.
The NCSC's own PDNS works this way: the NCSC curates rules for how DNS responses should be modified when a user queries a malicious domain, codifies them in a Response Policy Zone, and its resolvers apply them. Commercial protective DNS services do the same job but manage the rules, threat feeds and resolvers for you.
You can build a DNS firewall yourself on your own resolvers, but you then own the threat feeds, the updates, the resilience of the resolvers and the reporting. For most organisations a managed protective DNS service is simpler. Our guide to the DNS sinkhole explains the redirect option in more detail.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Making protective DNS hard to bypass
Protective DNS only protects lookups that reach it. The NCSC's guidance is specific about closing the gaps:
- Point every network at the protective resolvers, either directly or by forwarding from your internal DNS servers.
- Block outbound DNS that does not go through your resolver. The NCSC recommends configuring firewalls to block outbound DNS requests on port 53 or 853 that do not go via the protective resolver.
- Control DNS over HTTPS. Either disable DoH in operating systems and browsers, or configure it to use the protective resolver in a way that still allows logging. See should you block DNS over HTTPS?
- Manage it centrally. Use Group Policy for Microsoft systems, mobile device management for other devices, and allow and deny lists for applications.
- Cover devices off the network with a roaming client so laptops resolve through the protective service at home and on public Wi-Fi. See DNS roaming clients.
Encrypted DNS is the gap most likely to undermine protective DNS today, because browsers and apps can send DNS inside ordinary HTTPS traffic. Our hub on encrypted DNS explains what that means for protective DNS and how the services we supply handle it.
Protective DNS options we supply
Forever Systems is a Cisco Partner and supplies several commercial protective DNS services. Which one fits depends on what you already run: some are standalone DNS services, some are add-ons to endpoint protection, and some are switched on in a firewall subscription.
| Option | Type | How it covers off-site devices | Our guide |
|---|---|---|---|
| Cisco Umbrella DNS Security and Cisco Secure Access DNS Defense | Standalone cloud DNS-layer security | Cisco Secure Client roaming module; Cisco Security for Chromebook | Cisco DNS-layer security |
| DNSFilter | Standalone cloud DNS filtering | Roaming clients for Windows, macOS, iOS, Android and Chrome on the Plus and Enterprise plans | Cisco Umbrella vs DNSFilter |
| Webroot DNS Protection | Add-on to Webroot Business Endpoint Protection | The Webroot agent, which supports DNS over HTTPS | Webroot DNS Protection explained |
| ThreatDown DNS Filtering | Add-on to ThreatDown endpoint bundles | The ThreatDown agent on each device | ThreatDown DNS Filtering explained |
| WatchGuard DNSWatch | Firebox firewall security service, in the Prime and Total Security Suites | Protects lookups that go through the Firebox; ask us about devices off site | WatchGuard DNSWatch |
Cisco Umbrella reaches its last day to order on 31 January 2027, and Cisco names Secure Access DNS Defense as the successor, so new Cisco buyers should compare the two before ordering. Sophos DNS Protection, SASE platforms and other options are compared on our DNS security solutions page.
We can help you shortlist against the NCSC criteria above, run a trial on your own traffic, and set up the firewall and device policies that stop protective DNS being bypassed. Contact us to talk it through; pricing depends on users, devices and plan, so ask us for a quote.
Protective DNS services explained
How Forever Systems helps with DNS security
We are an independent UK IT and cyber security provider and a Cisco Partner. We supply Cisco Umbrella and Cisco Secure Access DNS Defense, and a range of other DNS filtering options, so we can recommend what fits rather than one answer for everyone.
- Start with what you have: we look at your firewall, endpoint protection and Microsoft 365 licences first, as some already include DNS or web filtering
- Choosing a service: Cisco DNS-layer security, DNS filtering bundled with endpoint protection, or a protective DNS service from the public sector, compared in plain English
- Set-up and roll-out: network forwarding, roaming clients for laptops off site, policies, block pages and controls to stop encrypted DNS bypassing the filter
- Migration help, including planning a move from Umbrella DNS packages to Cisco Secure Access DNS Defense
- Ongoing help: policy changes, reporting reviews, licence management and renewals, agreed at quote
We work with businesses, schools, charities and public sector organisations.
Frequently asked questions
What is protective DNS?
Protective DNS (PDNS) is a recursive DNS resolver that checks each lookup against threat intelligence and refuses to resolve domains known to be malicious. Devices therefore cannot reach malware, phishing or command-and-control sites, and the blocked requests give you evidence of infected or targeted devices.
Is protective DNS the same as a DNS firewall?
They describe the same idea. "DNS firewall" usually refers to Response Policy Zones (RPZ), a way of overlaying your own policy on DNS answers, and the NCSC's PDNS uses an RPZ. A protective DNS service is a managed resolver that applies those rules for you, with threat feeds, reporting and support.
Who can use the NCSC's PDNS?
The NCSC's PDNS is mandated by the Cabinet Office for central government departments and is available to other organisations that meet the NCSC's eligibility criteria, which it reviews on an ongoing basis. Since October 2024 the NCSC has offered PDNS for Schools to all UK schools, including multi-academy trusts, academies and independent schools. Check the NCSC's PDNS page before applying through MyNCSC.
What should a commercial protective DNS service offer?
Following the NCSC's private-sector guidance: regularly updated threat intelligence, an admin interface, exportable logs for your SIEM, editable allow lists, a choice of block response, DNSSEC and encrypted DNS support, a roaming client, ways to prevent bypass, clear data handling and a service level agreement.
Does protective DNS replace antivirus or a web filter?
No. Protective DNS blocks known-bad domains at the lookup, but it does not inspect files, see full web addresses or catch connections made directly to an IP address. Use it alongside endpoint protection, email security and, where you need page-level control, a secure web gateway. We can help you work out which layers you already have and where protective DNS fits.
Still have a question about Protective DNS?
Ask us and a member of our team will reply by email.