Skip to content
Cloudflare for Teams
Visit Cloudflare for Teams on GitHub
Set theme to dark (⇧+D)


Cloudflare Gateway’s DNS filtering capabilities allow you to block known and potential security risks on the public Internet, as well as specific categories of content. To give you more granular control over how to secure your network, Gateway also provides you with categorized security risks and content categories.

You can block security risks and content categories by creating DNS policies. Once you have configured your policies, you will be able to inspect network activity and the associated categories in your Gateway logs.

Security risk categories

AnonymizerSites that allow users to surf the Internet anonymously.
Command and Control & BotnetSites that are queried by compromised devices to exfiltrate information or potentially infect other devices in a network.
CryptominingSites that mine cryptocurrency by taking over the user's computing resources.
DGA DomainsDomains detected as generated by algorithms seen in malware.
DNS TunnelingDomains with detected DNS tunneling activity.
MalwareSites hosting malicious content and other compromised websites.
New DomainsDomains that have been registered very recently.
Newly Seen DomainsDomains that have recently been resolved for the first time.
PhishingDomains that are known for stealing personal information.
Private IP AddressDomains that resolve to private IP Addresses.
SpamSites that are known for targeting users with unwanted sweepstakes, surveys, and advertisements.
SpywareSites that are known to distribute or contain code that displays unwanted advertisements or that gathers user information without the user’s knowledge.
UnreachableDomains that resolve to unreachable IP addresses.

Block security risk categories

  1. Navigate to the Policies tab in the Teams dashboard.
  2. Create a new policy, or edit an existing one.
  3. Navigate to the Security risks tab.

Security risks page

  1. Select all the security risk categories you want your policy to block.
  2. Click Save to finalize your changes.

Content categories

Adult ThemesSites that are hosting content related to pornography, nudity, sexuality, and other adult themes.
Business & EconomySites that are related to business, economy, finance, education, science and technology.
Deceptive AdsSites that spoof clicks, impressions, conversions for ads.
DrugsSites related to the use and promotion of illegal drugs or illegal use of prescribed drugs.
EducationSite hosting educational content that are not included in other categories like Science, Technology or Educational institutions.
EntertainmentSites that are hosting entertaining content that are not included in other categories like Comic books, Audio streaming, Video streaming etc.
GamblingSites that are providing online gambling or are related to gambling.
Government & PoliticsSites related to government and politics.
HealthSites containing information about health and fitness.
Information TechnologySites related to information technology.
Internet CommunicationSites hosting applications that are used for communication like chat, mail etc.
Job Search & CareersSites that facilitate searching for jobs and careers.
Login ScreensSites hosting login screens that are not included in other categories.
MiscellaneousSites that are not included in the listed security and content categories.
No ContentSites that have no content.
Questionable ContentSites hosting content that are related to hacking, piracy, profanity and other questionable activities.
Real EstateSites related to real estate.
ReligionSites hosting content about religion, alternative religion, religious teachings, religious groups and spirituality.
Safe for KidsSites that are safe for kids to visit.
Security threatsSites that contain security threats like malware, phishing, cryptomininng and other security threats.
Shopping & AuctionsSites that are hosting content related to ecommerce, coupons, shopping, auctions and marketplaces.
Social & FamilySites related to society and lifestyle.
Society & LifestyleSites hosting information about lifestyle that are not included in other categories like fashion, food & drink etc.
SportsSites related to sports & recreation.
TechnologySites hosting information about technology that are not included in the science category.
TravelSites that contain information about listings, reservations, services for travel.
VehiclesSites related vehicles, automobiles, including news, reviews, and other hobbyist information.
ViolenceSites hosting and/or promoting violent content.
WeatherSites related to weather.

Blocking content categories

  1. Navigate to the Policies tab in the Teams dashboard.
  2. Create a new policy, or edit an existing one.
  3. Navigate to the Content categories tab.

Content categories page

  1. Select all the content categories you want your policy to block.
  2. Click Save to finalize your changes.

Test a policy

If you are blocking a security threat or content category, you can test that the policy is working by using the test domain associated with each category.

Once you have configured your Gateway policy to block the category, the test domain will show a block page when you attempt to visit the domain in your browser, or will return REFUSED when you perform dig using the command-line interface.

Test domains

One-word categories

Test domains use the following format for categories with one-word names:

CategoryTest domain

Multi-word categories

If the category has multiple words in the name (e.g. Parked & For Sale Domains) then the test domain uses the following format:

  • Remove any spaces between the words
  • Replace & with and
  • All letters are lowercase
CategoryTest domain
Parked & For Sale
Private IP
Command and Control &

Common test domains

CategoryTest domain
Command and Control &
Parked & For Sale
Private IP