Skip to main content

DNS filtering

Updated

Overview

Shield DNS is the web filtering component of Shield. It works by examining every domain lookup made by devices on your school's network and deciding whether to allow or block it. Filtering happens before a page loads, so harmful or inappropriate sites are stopped at the network level.

How DNS Filtering Works

When a device on your network tries to visit a website, it first looks up the domain's address (a process called DNS resolution). Instead of using a standard DNS provider, Shield-protected networks point their DNS requests to Shield's resolvers. Shield evaluates each domain and returns either an address (allow) or a block response.

This approach means:

  • Filtering works on every device that uses your network's DNS, including school-issued laptops, Chromebooks, tablets, and shared computers
  • No software installation is required on the device for network-level filtering
  • For devices that leave the school network (students taking laptops home), the Chrome extension extends filtering off-campus

The Five Verdict Tiers

Shield uses a five-tier pipeline to decide what to do with each domain. It checks faster, more reliable sources first and only escalates to slower, more thorough methods when needed. Most lookups resolve from cache in under 10ms.

Tier What it checks Speed
Tier 0 Cached result from a previous lookup; your allow/block lists; cross-MSP fleet consensus on known threats Under 10ms
Tier 1 Live threat-intelligence feeds: URLhaus, ThreatFox, PhishTank, OTX Under 300ms
Tier 2 AI name analysis — a fast AI model evaluates the domain name itself and Tier 1 context About 1 second
Tier 3 Full-page crawl — Shield visits the site, reads the content, and runs an AI verdict on what it finds 10–20 seconds
Tier 4 Deep threat analysis for domains with serious threat indicators Background; result appended to the verdict record

The pipeline terminates as soon as a confident decision is reached. The vast majority of common websites are resolved from Tier 0 cache.

Verdicts Explained

Shield returns one of four verdicts for any domain:

  • Allow — The domain is safe. The device's DNS request is answered normally.
  • Block — The domain is harmful or policy-violating. The device receives a block response and the user sees a block page.
  • Allow with monitoring — The domain is allowed but flagged for trend analysis.
  • Uncertain — The system could not reach a confident verdict and escalates to the next tier.

CIPA Compliance Reporting

For schools receiving E-Rate funding, CIPA (Children's Internet Protection Act) compliance is a requirement. Shield logs every block that falls into a CIPA-relevant category:

  • Obscene content
  • Material harmful to minors
  • Child safety concerns

These logs are retained and available as a compliance report you can generate for any date range up to 400 days. The report is formatted for E-Rate filing purposes.

CIPA mode must be enabled in the client configuration for this logging to occur. It is turned on by default when a K-12 school is activated.

Adding an Allow or Block Entry

If you need to immediately allow a domain that Shield is blocking, or block a domain that Shield is allowing, you can add it to a list directly.

To allow a domain:

  1. Open the Lists section in the portal.
  2. Enter the domain and an optional reason.
  3. Save. The cache for that domain is immediately invalidated, so the next lookup reflects the new rule.

To block a domain:

  1. Open the Lists section.
  2. Choose Block List and select the scope.
  3. Enter the domain and an optional reason.
  4. Save. Takes effect on the next lookup for that domain.

For more detail on how list scopes work and how they interact, see Allow and Block Lists.

Frequently Asked Questions

Does DNS filtering work for students on mobile data?

No. DNS filtering only applies to network traffic routed through Shield's resolvers. A student using their phone's cellular data on a personal device is outside Shield's reach. The Chrome extension helps with school-issued devices that go off-campus but does not extend to personal mobile data connections.

Can a student bypass filtering using a VPN?

A VPN would route the DNS lookups outside Shield's resolvers, bypassing filtering. Schools can add VPN-related services to the block list to discourage this. For deeper protection on managed devices, consult your MSP about additional policy options.

How often are the threat-intelligence feeds updated?

The live threat feeds are synced every 30 minutes. The allow-lists for services like Microsoft 365 and major CDNs are refreshed weekly.

What happens when Shield blocks a site — what does the student see?

The student's browser receives a block response from the DNS resolver and typically lands on a block page. The exact appearance depends on how your network is configured.

Related