Common policies

The following policies are commonly used to secure DNS traffic.

Refer to the DNS policies page for a comprehensive list of other selectors, operators, and actions.

Allow corporate domains

This policy allows users to access official corporate domains. By deploying the policy with high order of precedence, you ensure that employees can access trusted domains even if they fall under a blocked category like Newly seen domains or Login pages.

Selector	Operator	Value	Action	Precedence
Domain	in list	Allowed domains	Allow	1

Block security threats

Block security categories such as Command & Control, Botnet and Malware based on Cloudflare’s threat intelligence.

Selector	Operator	Value	Action
Security Categories	in	All security risks	Block

Block content categories

The categories included in this policy are not always a security threat, but blocking them can help minimize the risk that your organization is exposed to. For more information, refer to domain categories.

Selector	Operator	Value	Action
Content Categories	in	Questionable Content, Security Risks, Miscellaneous	Block

Block unauthorized applications

To minimize the risk of shadow IT, some organizations choose to limit their users’ access to certain web-based tools and applications. For example, the following policy blocks AI assistants:

Selector	Operator	Value	Action
Application	in	Microsoft Copilot, ChatGPT, Google Gemini	Block

Note

After seven days, view your shadow IT analytics and block additional applications based on what your users are accessing.

Block banned countries

You can implement policies to block websites hosted in countries categorized as high risk. The designation of such countries may result from your organization’s customers or through the implementation of regulations including EAR ↗, OFAC ↗, and ITAR ↗.

Selector	Operator	Value	Action
Resolved Country IP Geolocation	in	Afghanistan, Belarus, Congo (Kinshasa), Cuba, Iran, Iraq, Korea, North, Myanmar, Russian Federation, Sudan, Syria, Ukraine, Zimbabwe	Block

Block top-level domains

Blocking frequently misused ↗ top-level domains (TLDs) can reduce security risks, especially when there is no discernible advantage to be gained from allowing access. Similarly, restricting access to specific country-level TLDs may be necessary to comply with regulations like ITAR ↗ or OFAC ↗.

Selector	Operator	Value	Logic	Action
Domain	matches regex	[.](cn|ru)$	Or	Block
Domain	matches regex	[.](rest|hair|top|live|cfd|boats|beauty|mom|skin|okinawa)$	Or
Domain	matches regex	[.](zip|mobi)$

Block phishing attacks

To protect against sophisticated phishing attacks ↗, you could prevent users from accessing phishing domains that are specifically targeting your organization. The following policy blocks specific keywords associated with an organization or its authentication services (such as okta, 2fa, cloudflare or sso), while still allowing access to official corporate domains.

Selector	Operator	Value	Logic	Action
Domain	not in list	Corporate Domains	And	Block
Domain	matches regex	.*okta.*|.*cloudflare.*|.*mfa.*|.sso.*

Block online tracking

To safeguard user privacy, some organizations will block tracking domains such as dig.whatsapp.com as well as other tracking domains embedded at the OS level. This policy is implemented by creating a custom blocklist. Refer to this repository ↗ for a list of widespread tracking domains that you can add to your blocklist.

Selector	Operator	Value	Action
Domain	in list	Top tracking domains	Block

Block malicious IPs

Block specific IP addresses that are known to be malicious or pose a threat to your organization. This policy is usually implemented by creating custom blocklists or by using blocklists provided by threat intelligence partners or regional Computer Emergency and Response Teams (CERTs).

Selector	Operator	Value	Action
Resolved IP	in list	DShield	Block

CIPA Filter

The CIPA Filter is a collection of subcategories that encompass a wide range of topics that could be harmful or inappropriate for minors. It is used as a part of Project Cybersafe Schools to block access to unwanted or harmful online content.

Selector	Operator	Value	Action
Content Categories	in	CIPA Filter	Block

Hide explicit search results

SafeSearch is a feature of search engines that helps you filter explicit or offensive content. You can enable SafeSearch on search engines like Google, Bing, Yandex, YouTube, and DuckDuckGo:

Selector	Operator	Value	Action
Content Categories	in	Search Engines	Safe Search

Check user identity

Configure access on a per user or group basis by adding identity-based conditions to your policies.

Selector	Operator	Value	Logic	Action
Application	in	Salesforce	And	Block
User Group Names	in	Contractors

Restrict access to specific groups

Filter DNS queries to allow only specific users access.

The following example includes two policies. The first policy allows the specified group, while the second policy blocks all other users. To ensure the policies are evaluated properly, place the Allow policy above the Block policy. For more information, refer to the order of precedence.

1. Allow a group

Selector	Operator	Value	Logic	Action
Content Categories	in	Social Networks	And	Allow
User Group Names	in	marketing-team

2. Block all other users

Selector	Operator	Value	Action
Content Categories	in	Social Networks	Block

Control IP version

Enterprise users can pair these policies with an egress policy to control which IP address is used to egress to the origin server.

Note

To ensure traffic routes via your preferred IP version, disable Display block page.

Force IPv4

Force users to connect with IPv4.

Selector	Operator	Value	Logic	Action
Query Record Type	is	AAAA	And	Block
Domain	is	example.com

Force IPv6

Force users to connect with IPv6.

Selector	Operator	Value	Logic	Action
Query Record Type	is	A	And	Block
Domain	is	example.com