FiveGuardian5 DNS filtering
All DNS queries from protected devices are sent by default to the FiveGuardian5 filtering resolver. The resolver blocks malicious or unwanted domains (for example, phishing or malware distribution) before the device connects to them.
This filtering applies both at the office and outside it, and it is designed so that users cannot avoid it by changing their device's DNS server.
Exceptions for business domains
Sometimes a legitimate service the organization uses can be affected by filtering, for example a cloud application such as Salesforce. In that case the FiveGuardian5 team can exempt specific business domains after reviewing them.
- Users request the exception through Support, stating the exact domain and why it is needed.
- Exceptions are limited to the necessary domains; filtering is not disabled in general.
Nameservers
DNS › Nameservers defines which DNS servers answer queries for certain domains or for everything, and which device groups each configuration applies to. It is useful, for example, so that names in an internal domain are resolved by the internal network's DNS servers.
Zones
DNS › Zones lets you define custom DNS zones with your own records, which devices in the network will resolve. Use them to give easy-to-remember names to internal services. Use the organization's own internal domains and avoid creating records for third-party public domains.
DNS Settings
DNS › DNS Settings holds general options, such as the device groups for which DNS management is disabled. Disabling DNS management for a group makes those devices stop using the FiveGuardian5 configuration; do not do it without coordination, because it affects filtering.
Good practices
- Change DNS configuration outside peak hours and verify resolution with a test device.
- Document each nameserver and custom zone with its purpose.
- Changes are recorded in Audit Events.
- For domain-based resources, see Domain resources.