NCSC PDNS: free protective DNS for the UK public sector and schools

What NCSC PDNS is

The NCSC's Protective Domain Name Service (PDNS) is a recursive DNS resolver that prevents access to domains known to be malicious, simply by not resolving them. The NCSC says it was built to hamper the use of DNS for malware distribution and operation. It was created by the NCSC and is implemented by Cloudflare and Accenture. The NCSC says it also gives the organisations that use it metrics about the health of their networks and access to NCSC outreach support to resolve any issues.

It is one of the NCSC's Active Cyber Defence capabilities. The service is free, because it is centrally funded by the NCSC, and the Cabinet Office has mandated it for central government departments. Other eligible organisations can choose to use it.

PDNS only changes how your users' lookups are answered. The NCSC is explicit that managing your own domains (authoritative DNS) is separate and is not affected by adopting PDNS, so your website and email records stay with whoever hosts them today.

The NCSC lists these benefits:

• Blocking malware and malicious sites: PDNS prevents access to sites hosting malware, ransomware and spyware, and blocks malware communication, which helps contain active threats.
• Dashboards and data logs so organisations can monitor the state of their networks and resolve issues.
• Expertise: subject matter expertise from the NCSC and Cloudflare, including analysis and incident management capabilities.
• SIEM integration: PDNS block data can be ingested into security information and event management tools, with connectors available for Microsoft Sentinel and Splunk.

The NCSC also uses data from PDNS to inform and support UK government cyber incident response if there is an attack.

NCSC PDNS at a glance

Everything in this table comes from the NCSC's own published description of the service. The NCSC reviews eligibility on an ongoing basis and publishes any changes on its PDNS page, so check there for the current position.

Who can use NCSC PDNS

The NCSC says PDNS is mandated for central government departments and available to other organisations that are eligible under its published criteria. Rather than repeat a list that can change, we point you to the NCSC's PDNS page, which says that eligibility is reviewed on an ongoing basis.

Two groups are worth calling out because the NCSC has announced them publicly:

• Schools. In October 2024 the NCSC extended PDNS for Schools to all UK schools, encouraging multi-academy trusts, academies, independent schools and school internet service providers to sign up. Local authorities, eligible public sector networks from the devolved administrations and local authorities in England that provide DNS to their maintained schools were already eligible. See our guide to PDNS for Schools.
• Central government. The Cabinet Office has mandated PDNS for central government departments.

If you are a private sector organisation, the NCSC publishes separate guidance on protective DNS for the private sector, aimed at organisations that do not qualify to use the NCSC's PDNS. Our protective DNS guide turns that guidance into a checklist for choosing a commercial service.

How NCSC PDNS works

The NCSC curates a set of rules for how a DNS response should be modified when a user queries a malicious domain. The rules are held in a database called a Response Policy Zone (RPZ), which the PDNS resolvers apply. The NCSC builds the rules from knowledge of malicious domains obtained from commercial, internal and open sources, and reviews them so that domains used for legitimate purposes are not blocked by accident.

When a domain is blocked, users see a block page rather than the site. Behind the scenes, the blocked request is logged, which is where the dashboards and SIEM feeds come from.

To use it, your network's DNS resolvers, or the forwarders on your internal DNS servers, send queries to PDNS instead of to your internet provider's resolvers. Devices that leave the network need PDNS Roaming, described below, or they will use whatever resolver the local network hands them.

A protective resolver can only protect queries that reach it. The NCSC's own guidance on protective DNS recommends blocking outbound DNS on ports 53 and 853 that does not go via your chosen resolver, and either disabling DNS over HTTPS in operating systems and browsers or configuring it to use the protective resolver in a way that keeps logging. Our page on blocking DNS over HTTPS covers how to do that in practice.

PDNS Roaming for remote and home users

PDNS Roaming is for users who work remotely or from home without a VPN or an enterprise DNS resolver, where you may not know their devices' IP addresses but still want them protected. The NCSC says it is available for Windows, macOS and iOS, directs DNS traffic to PDNS and lets devices reach PDNS from outside the office network using the encrypted DNS over HTTPS (DoH) protocol. The NCSC's PDNS Knowledge Base has more detail under Roaming.

Two practical points follow:

• Android phones and Chromebooks are not in the NCSC's list of supported systems for PDNS Roaming, so plan how you will cover them, for example with a commercial roaming client or by keeping them on networks you control.
• Because Roaming uses DoH, it fits well with encrypted DNS policies. Our guides to DNS over HTTPS and DNS roaming clients explain the wider picture.

How to sign up, and the NCSC PDNS login

Registration is handled entirely by the NCSC. Its PDNS page says to sign in to your MyNCSC account and complete the PDNS sign-up form, after checking the eligibility criteria. Queries about registration go to the NCSC's PDNS team, using the contact details on that page.

If you are looking for the "NCSC PDNS login", the starting point is MyNCSC, the NCSC's portal for its services; once you are registered, follow the NCSC's own instructions for the PDNS dashboards. Forever Systems does not run, resell or administer NCSC PDNS, and we cannot sign in to it for you.

For schools, the NCSC's October 2024 announcement says all educational organisations can sign up by asking their DNS provider to register for PDNS through MyNCSC, and the Department for Education's Cyber Security Hub says schools can apply through their local authority, their multi-academy trust or directly through the NCSC.

Once you are registered, check that it is working: confirm which resolver each network and device is really using, test from guest Wi-Fi and from home, and check that browsers are not sending lookups elsewhere. Our DNS security test guide walks through those checks.

What NCSC PDNS does not do

NCSC PDNS is a valuable, free security control, but it is deliberately narrow. Be clear about what sits outside it:

None of this is a criticism. PDNS does one job at no cost, and if you qualify the NCSC is clear that a commercial protective DNS service should not be considered a substitute. The question is what you run alongside it.

How we can help

We do not provide NCSC PDNS, but we can help eligible organisations get the most from it and cover what it leaves out. That can include reviewing which resolvers your networks and devices really use, the firewall rules and device policies that stop DNS bypass, content filtering where you need it, roaming protection for devices PDNS Roaming does not support, and getting logs into your SIEM.

If you are not eligible, we can help you choose a commercial service using the NCSC's own criteria; see protective DNS and the DNS security solutions we supply. Contact us to talk it through.