I was wondering what would be the best way to implement DNS filterting.

The scenario is this: we need to setup two custom DNS servers to use on our company's computers so that we can filter DNS requests for certain domains and return custom IPs and forward other requests to our ISPs DNS servers.

We were thinking about using either PowerDNS or MyDNS because they support MySQL out of the box and we need to change the list of domains to filter quite often.


As Ed Fries suggests, the DNS solutions is:

  1. Set up a (or two) DNS server(s) with either forwarding or the root hints zone, which will make it return non-authoritative answers for all domains on the internet.
  2. Set your clients to use this/these DNS servers, by configuring your DHCP server appropriately (or manually on the client).
  3. Optionally block 53/udp outbound on your firewall, to prevent clients on your network from using another DNS server.
  4. Create an authoritative zone on your DNS server for the domains you want to block, and optionally create A/CNAME etc records for them. Doing this will prevent your DNS server from forwarding the request on and getting the real answer, as it thinks it is authoritative.

There are ways around this:

  • If you don't do step 3, clients can simply use a public DNS server (eg, Google provides public DNS)
  • People can use a VPN/proxy to get past it
  • For some sites, they'll be able to type in the IP (if they know it) and get to the site anyways, no configuration changes needed.

There are other ways to block sites (block the IP at the firewall, for example) that may be a bit more reliable/less work, though for almost everything there is a way around it if your users are savvy enough.


Filtering is easier than "rerouting" but is best done via a proxy or web content filter, either hardware or a service.

Rerouting certain domains, say MySpace.com, by creating an authoritative zone on your DNS server and then creating your own A/CNAME records, will probably be an administrative challenge at best and difficult to centrally bypass if someone has a legitimate need to access the site. On the other hand it can be easily bypassed by savvy users with a proxy service/client on the workstation.

You should post more details on what you are trying to accomplish and why for a more detailed answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.