Phishing and fraudulent websites
Block access to domains associated with phishing and malicious content.
Where the module helps during an attack
DNS protection mainly helps at the start of an attack and when malware attempts outbound communication. This is an indicative view, not a measurement.
| Area | Level |
|---|---|
| Reconnaissance | no direct role |
| Initial access | primary role |
| Execution and persistence | additional protection |
| Escalation and lateral movement | context |
| Impact | additional protection |
| Investigation and recovery | additional protection |
Block malicious domains before a connection is made
When users click links or programs contact servers, devices first ask DNS where to connect. DNS Security checks these queries and blocks connections to malicious domains.
The vendor combines threat databases with Predictive DNS, which estimates potential abuse from domain characteristics. The module complements antivirus with protection at the network communication layer.
Malware command-and-control servers
Interrupt communication between infected devices and attacker infrastructure.
Categories and exceptions
Category-based blocking, custom allowlists and blocklists, and a company-branded blocking page.
Network and endpoint variants complement each other
DNS Security – Network is configured on your DNS servers. Queries are either forwarded to Heimdal resolvers or filtered locally by Hybrid DNS on the server, covering printers, IoT and other devices that cannot run an agent.
DNS Security – Endpoint runs in the Heimdal computer agent. It filters DNS, HTTP and HTTPS traffic, including DNS over HTTPS, outside the corporate network too. It identifies the process behind blocked connections.
- Network: devices on the corporate network, including those without an agent.
- Endpoint: agent-equipped laptops and servers, including remote and travelling users.
- Combined: protection for the network and devices that leave it.
A practical starting point for smaller teams
DNS Security suits businesses adding preventive protection without replacing existing antivirus. The vendor describes it as complementary to antivirus, firewalls, IDS and IPS.
Cloud app visibility through App Discovery and CASB helps identify services used in the business and block unapproved ones.
- Users frequently open links in email and on the web.
- Some devices work outside the corporate network.
- Some business devices cannot run an agent.
- You want to know which cloud services people actually use.
Deployment with APPSEC: from pilot to policies
Heimdal is responsible for the product and threat databases. APPSEC provides design, deployment and support as agreed. You approve blocking rules and exceptions.
Variant selection
We review your network, DNS servers and remote work, then choose network, endpoint or combined protection.
Pilot
We enable protection on selected devices or one server and monitor blocking and false positives.
Rules
We configure categories, exceptions and the blocking page to match company policy.
Handover
We show your team how to interpret events and when to escalate. Post-deployment support is specified in the proposal.
Before you start
- The vendor compatibility matrix lists the endpoint variant for Windows and macOS, not Ubuntu.
- The network variant requires DNS server access and a decision between query forwarding and local filtering.
- Endpoint licensing is per device. Network licensing is based on DNS query volume.
- Blocking rules can affect legitimate services. A pilot and clear exception process help prevent disruption.
