DNS filtering

Secure Web Gateway allows you to inspect DNS traffic and control which websites users can visit.

Note

For a more detailed guide to filtering DNS queries and other traffic for your organization, refer to the Secure your Internet traffic and SaaS apps implementation guide.

1. Connect to Gateway

Connect devices

To filter DNS requests from an individual device such as a laptop or phone:

1. Install the WARP client on your device.
2. In the WARP client Settings, log in to your organization’s Zero Trust instance.
3. (Optional) If you want to display a custom block page, install the Cloudflare root certificate on your device.

Connect DNS locations

To filter DNS requests from a location such as an office or data center:

1. Add the location to your Zero Trust settings.
2. On your router, browser, or OS, forward DNS queries to the address shown in the location setup UI.

Note

Gateway identifies locations differently depending on the DNS query protocol:

• IPv4 queries match to the source IP address. Under Gateway > DNS locations, ensure that the Source IPv4 Address parameter is correct for the location you want to apply policies to.
• IPv6, DOT, or DOH queries match to the unique DNS forwarding address assigned to the DNS location. Ensure that your DNS resolver is configured for the location you want to apply policies to.

2. Verify device connectivity

1. In Zero Trust ↗, go to Settings > Network.
2. Under Gateway logging, enable activity logging for all DNS logs.
3. On your device, open a browser and go to any website.
4. In Zero Trust, go to Logs > Gateway > DNS.
5. Make sure DNS queries from your device appear.

3. Add recommended policies

To create a new DNS policy, go to Gateway > Firewall policies > DNS in Zero Trust. We recommend adding the following policy:

Block all security categories

Block known threats such as Command & Control, Botnet and Malware based on Cloudflare’s threat intelligence.

Selector	Operator	Value	Action
Security Categories	in	All security risks	Block

4. Add optional policies

Refer to our list of common DNS policies for other policies you may want to create.