TL;DR:

  • DNS filtering blocks connections to known malicious websites at the network level — before malware can download, before phishing pages can load
  • It works for every device on your network without installing anything on individual computers
  • Cloudflare Gateway and NextDNS both have free tiers that are genuinely good enough for most small businesses

Most cyber attacks against small businesses start the same way: someone clicks a link. The link might be in a phishing email, an SMS, a fake invoice, or a malicious ad on a legitimate website. The link leads to a website that either installs malware, steals login credentials, or tricks someone into doing something they shouldn’t.

DNS filtering stops a significant percentage of these attacks before they can cause harm — and it does so at a layer where you don’t need to install anything on individual devices or retrain your staff.

What DNS Actually Is

Every time you visit a website, your device first looks up the site’s address through the Domain Name System (DNS). You type bank.com; your device asks a DNS server “what’s the IP address for bank.com?”; the DNS server replies with the numbers; your browser connects.

This lookup happens hundreds of times a day for every device on your network — for websites, for email, for software updates, for everything that touches the internet. It’s the first step in every internet connection.

DNS filtering intercepts these lookups and compares the requested domain against a database of known malicious sites. If someone on your network tries to visit free-prize-claim-definitely-not-malware.com, the DNS filter checks its database, finds that domain is a phishing site, and returns an error instead of the real address. The connection never happens. The malicious page never loads.

What DNS Filtering Blocks

Good DNS filtering services maintain continuously-updated databases of:

  • Malware download sites — domains hosting ransomware, trojans, and spyware
  • Phishing pages — fake login pages impersonating banks, Microsoft 365, HMRC, and other trusted sites
  • Command-and-control servers — the servers that malware phones home to after infection (blocking these can contain infections you already have)
  • Newly registered domains — domains registered in the last 30 days, which are disproportionately used in attacks
  • Typosquatting domains — micros0ft.com, 1ogin-paypal.com, and similar fake domains designed to catch mistyped URLs

A typical DNS filter blocks around 5–15% of outbound DNS queries in business environments — the vast majority of these are trackers and ads, but a meaningful fraction are genuinely malicious.

The Three Tools Worth Knowing

Cloudflare Gateway (Free and Paid)

Cloudflare runs one of the world’s largest DNS networks and offers a security-focused DNS service through Cloudflare Gateway. The free version provides malware and phishing blocking using Cloudflare’s threat intelligence — which is substantial, given that Cloudflare processes a significant fraction of global internet traffic.

Free tier: Change your router’s DNS to 1.1.1.2 and 1.0.0.2 (Cloudflare’s malware-blocking DNS). No account required. Every device on your network is protected instantly.

Paid tier (Cloudflare Zero Trust Teams — free for up to 50 users): Create a Cloudflare Zero Trust account and you get a custom DNS endpoint with full policy control, activity logs showing every domain resolved by every device, the ability to block categories (social media, gambling, adult content), and integration with identity providers. For 50 users or fewer, this tier is free and genuinely excellent.

NextDNS

NextDNS is a privacy-focused DNS filtering service with one of the most granular configuration options available. You get a personal DNS endpoint with detailed logs, support for dozens of blocklists (including the OISD list, HaGeZi, and others), and per-device or per-profile configuration.

Pricing: Free tier allows 300,000 DNS queries per month (enough for a very small team). Paid plans start at around €2/month for unlimited queries. For most small businesses, the paid plan is affordable.

Setup: Create an account at nextdns.io, get your unique DNS ID, and configure it on your router. NextDNS provides step-by-step instructions for almost every router model.

Quad9

Quad9 (9.9.9.9) is a non-profit DNS resolver run in partnership with IBM, Packet Clearing House, and others. It blocks malicious domains using threat intelligence from over 25 global threat intelligence sources and is completely free.

Quad9 is the simplest option: change your router’s primary DNS to 9.9.9.9 and secondary to 149.112.112.112. No account, no configuration, no cost. It won’t give you logs or custom policies, but it blocks known malicious domains effectively.

Recommendation: Quad9 for businesses that want free protection with zero management overhead. Cloudflare Zero Trust for businesses that want logs and more control. NextDNS for businesses that want maximum configurability and are comfortable spending a few pounds per month.

Setting It Up on Your Router

The fastest way to protect every device on your network is to change the DNS settings on your router. All devices that connect to your Wi-Fi will automatically use the filtered DNS without any changes to individual computers, phones, or tablets.

Most routers have their settings at 192.168.1.1 or 192.168.0.1. Log in (the password is usually on a sticker on the router), find DNS settings (usually under “WAN” or “Internet” settings), and replace the DNS server addresses with your chosen provider’s addresses.

For Cloudflare malware blocking:

Primary DNS: 1.1.1.2
Secondary DNS: 1.0.0.2

For Quad9:

Primary DNS: 9.9.9.9
Secondary DNS: 149.112.112.112

Save and restart the router. Done. Every device on your network is now protected.

What DNS Filtering Doesn’t Do

DNS filtering is one layer of protection, not a complete security solution. It won’t:

  • Protect devices on mobile data: When staff use their phones or laptops on 4G/5G instead of your Wi-Fi, the office DNS filter doesn’t apply. For remote workers, using a device-level filtering app (NextDNS has excellent iOS and Android apps) extends protection to devices off-network.
  • Block HTTPS content inspection: DNS filtering works on the domain level, not the page level. It can block malicious-site.com entirely, but it can’t selectively block a malicious page on google.com or github.com.
  • Catch everything: Threat intelligence databases are updated continuously but not instantly. Brand-new malicious domains may slip through for a few hours before being listed.
  • Replace antivirus: DNS filtering reduces the malware that reaches devices; antivirus handles malware that gets through anyway. Both layers matter.

DNS Filtering and Cyber Essentials

If you’re working towards Cyber Essentials certification — which NCSC recommends for all UK businesses, and which is required for many government contracts — DNS filtering supports the “malware protection” control. Cyber Essentials requires either software-based malware protection or network-level filtering (DNS filtering qualifies as the latter) on all devices.

Setting up DNS filtering on your router and optionally deploying NextDNS or Cloudflare WARP on company devices covers this requirement cleanly and at low cost, while providing genuine protection beyond just satisfying an audit requirement.

For most small businesses, implementing DNS filtering is a two-hour task that provides lasting protection. Few security investments have this ratio of effort to impact.