Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering what would be the best way to implement DNS filterting.

The scenario is this: we need to setup two custom DNS servers to use on our company's computers so that we can filter DNS requests for certain domains and return custom IPs and forward other requests to our ISPs DNS servers.

We were thinking about using either PowerDNS or MyDNS because they support MySQL out of the box and we need to change the list of domains to filter quite often.

share|improve this question

As Ed Fries suggests, the DNS solutions is:

  1. Set up a (or two) DNS server(s) with either forwarding or the root hints zone, which will make it return non-authoritative answers for all domains on the internet.
  2. Set your clients to use this/these DNS servers, by configuring your DHCP server appropriately (or manually on the client).
  3. Optionally block 53/udp outbound on your firewall, to prevent clients on your network from using another DNS server.
  4. Create an authoritative zone on your DNS server for the domains you want to block, and optionally create A/CNAME etc records for them. Doing this will prevent your DNS server from forwarding the request on and getting the real answer, as it thinks it is authoritative.

There are ways around this:

  • If you don't do step 3, clients can simply use a public DNS server (eg, Google provides public DNS)
  • People can use a VPN/proxy to get past it
  • For some sites, they'll be able to type in the IP (if they know it) and get to the site anyways, no configuration changes needed.

There are other ways to block sites (block the IP at the firewall, for example) that may be a bit more reliable/less work, though for almost everything there is a way around it if your users are savvy enough.

share|improve this answer

Filtering is easier than "rerouting" but is best done via a proxy or web content filter, either hardware or a service.

Rerouting certain domains, say, by creating an authoritative zone on your DNS server and then creating your own A/CNAME records, will probably be an administrative challenge at best and difficult to centrally bypass if someone has a legitimate need to access the site. On the other hand it can be easily bypassed by savvy users with a proxy service/client on the workstation.

You should post more details on what you are trying to accomplish and why for a more detailed answer.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.