DNS filtering is the closest thing to a free win in small business security. It sits at the layer every connection has to pass through, works on devices you do not manage, and costs a few dollars per user per month. It is also, in our experience, the control most often missing.
How it works
Before a device can connect to anything, it asks a DNS resolver to turn a domain name into an IP address. A filtering resolver checks that domain against threat intelligence first. Known phishing, malware and command-and-control domains simply do not resolve — so the connection is never made.
The distinction matters. A firewall or endpoint agent generally inspects traffic after a connection is established. DNS filtering prevents the connection existing at all, which is both cheaper and considerably harder to work around.
Why it punches above its weight
Most malware needs to phone home. Ransomware retrieves its encryption keys, infostealers exfiltrate credentials, remote-access trojans await instructions — and the overwhelming majority resolve a domain to do it. Break that step and a successful infection frequently becomes an inert one.
It also catches user error that no other control does well. A staff member clicks a convincing invoice link on a personal laptop over the office WiFi; the endpoint agent you do not control never sees it, but the DNS request still goes through your resolver.
What it will not do
DNS filtering is not a substitute for MFA, patching or endpoint protection. It will not stop an attacker who already has valid credentials, and it will not help against malware using hard-coded IP addresses or DNS-over-HTTPS to a resolver you have not blocked. Treat it as one cheap layer among several, not a solution.
Implementing it properly
Deployment is straightforward: point your network DNS at the filtering service, or roll out a lightweight agent for laptops that leave the office. The two steps people skip are blocking outbound port 53 to everything except your resolver — otherwise devices simply bypass it — and actually reviewing the logs. Those logs are among the best early indicators you have that something on your network is misbehaving.