Recommended DNS policies
We recommend you add the following DNS policies to build an Internet and SaaS app security strategy for your organization.
All-DNS-Domain-Allowlist
Allowlist any known domains and hostnames. With this policy, you ensure that your users can access your organization's domains even if the domains fall under a blocked category, such as Newly Seen Domains or Login Screens.
| Selector | Operator | Value | Logic | Action |
|---|---|---|---|---|
| Domain | in list | Known Domains | Or | Allow |
| Host | in list | Known Domains |
Quarantined-Users-DNS-Restricted-Access
Restrict access for users included in an identity provider (IdP) user group for risky users. This policy ensures your security team can restrict traffic for users of whom malicious or suspicious activity was detected.
| Selector | Operator | Value | Logic | Action |
|---|---|---|---|---|
| Domain | in list | Known Domains | Or | Block |
| Host | in list | Known Domains | And | |
| User Group Names | in | Quarantined Users |
All-DNS-SecurityCategories-Blocklist
Block security categories, such as Command and Control & Botnet and Malware, based on Cloudflare's threat intelligence.
| Selector | Operator | Value | Action |
|---|---|---|---|
| Security Categories | in | All security risks | Block |
All-DNS-ContentCategories-Blocklist
Entries in the security risk content subcategory, such as New Domains, do not always pose a security threat. We recommend you first create an Allow policy to track policy matching and identify any false positives. You can add false positives to your Trusted Domains list used in All-DNS-Domain-Allowlist.
After your test is complete, we recommend you change the action to Block to minimize risk to your organization.
| Selector | Operator | Value | Action |
|---|---|---|---|
| Content Categories | in | Security Risks | Allow |
All-DNS-Application-Blocklist
Block unauthorized applications to limit your users' access to certain web-based tools and minimize the risk of shadow IT. For example, the following policy blocks popular AI chatbots.
| Selector | Operator | Value | Action |
|---|---|---|---|
| Application | in | Microsoft Copilot, ChatGPT, Google Gemini | Block |
All-DNS-GeoCountryIP-Blocklist
Block websites hosted in countries categorized as high risk. The designation of such countries may result from your organization's users or through the implementation of regulations including EAR ↗, OFAC ↗, and ITAR ↗.
| Selector | Operator | Value | Action |
|---|---|---|---|
| Resolved Country IP Geolocation | in | Afghanistan, Belarus, Congo (Kinshasa), Cuba, Iran, Iraq, Korea (North), Myanmar, Russian Federation, Sudan, Syria, Ukraine, Zimbabwe | Block |
All-DNS-DomainTopLevel-Blocklist
Block frequently misused top-level domains (TLDs) to reduce security risks, especially when there is no discernible advantage to be gained from allowing access. Similarly, restricting access to specific country-level TLDs may be necessary to comply with regulations such as OFAC ↗ and ITAR ↗.
| Selector | Operator | Value | Action |
|---|---|---|---|
| Domain | matches regex | [.](cn|ru)$ or [.](rest|hair|top|live|cfd|boats|beauty|mom|skin|okinawa)$ or [.](zip|mobi)$ | Block |
All-DNS-DomainPhishing-Blocklist
Block misused domains to protect your users against sophisticated phishing attacks, such as domains that specifically target your organization. For example, the following policy blocks specific keywords associated with an organization or its authentication services (such as okta, 2fa, cloudflare and sso) while still allowing access to known domains.
| Selector | Operator | Value | Logic | Action |
|---|---|---|---|---|
| Domain | not in list | Known Domains | And | Block |
| Domain | matches regex | .*okta.*|.*cloudflare.*|.*mfa.*|.sso.* |
All-DNS-ResolvedIP-Blocklist
Block specific IP addresses that are malicious or pose a threat to your organization.
You can implement this policy by either creating custom blocklists or by using blocklists provided by threat intelligence partners or regional Computer Emergency and Response Teams (CERTs). Ideally, your CERTs can update the blocklist with an API automation to provide real-time threat protection.
| Selector | Operator | Value | Action |
|---|---|---|---|
| Resolved IP | in list | IP Blocklist | Block |
All-DNS-DomainHost-Blocklist
Block specific domains or hosts that are malicious or pose a threat to your organization. Like All-DNS-ResolvedIP-Blocklist, this blocklist can be updated manually or via API automation.
| Selector | Operator | Value | Logic | Action |
|---|---|---|---|---|
| Domain | in list | Domain Blocklist | Or | Block |
| Host | in list | Host Blocklist | Or | |
| Host | matches regex | .*example\.com |