What is DNS protection, and why does it matter for your business?

DNS protection is the set of controls that stops the internet's address system being used against your business. It covers two things: filtering, which stops your team's devices reaching scam and malware websites even after someone clicks a bad link, and control of your own domain, so nobody can hijack it, redirect your website or send email that looks like it came from you. Phishing is still the most common attack UK businesses report, and DNS filtering is one of the few defences that keeps working after a convincing email has already got through.

What is DNS protection?

DNS protection works on the Domain Name System, the internet's address book. Every time someone in your team opens a website or sends an email, their device asks DNS where to go, and DNS turns a name like techoptimised.com into the numerical address a computer needs. Because almost everything your business does online starts with one of these lookups, it's a useful place for attackers to interfere and a useful place for you to stop them.

The protection works on both sides of that address book. On the way out, it checks each lookup your devices make and refuses to connect them to sites known to be dangerous. On your own side, it keeps your domain and its records in the right hands, so the address book always sends people to your genuine website and only the services you've approved can send email in your name.

How does DNS filtering stop attacks?

DNS filtering, which the NCSC calls protective DNS, sends your devices' lookups through a service that checks each one against lists of known malicious domains before it answers. If a domain is on the list, the answer never comes back and the page doesn't load. The NCSC's guidance on protective DNS describes what it typically blocks: sites that spread malware, the servers attackers use to control malware already on a device, and domains used for phishing and fraud.

That matters because the email that gets through is the one your team acts on. If someone clicks a link to a fake Microsoft 365 sign-in page, filtering can stop that page loading before they type their password. If a laptop is already infected, filtering can cut the malware off from the server it reports to. The service also keeps a record of what it blocked, which helps you work out which device clicked what when something goes wrong.

Two details decide whether filtering protects your whole team or only the office. The first is people working from home or on the move, because their laptops use whatever network they're connected to, so the NCSC notes that filtering services can install a small client on each device to send lookups through the filter wherever it is. The second is encrypted DNS in modern browsers, which can quietly bypass the filter unless it's switched off or pointed at the filtering service. Both are settings, and both are easy to miss when filtering is set up on the office router and left there.

What does DNSSEC add?

DNSSEC (Domain Name System Security Extensions) adds a digital signature to your domain's records, so the services looking them up can check the answer came from your domain and wasn't altered on the way. It protects against an attacker handing out a forged answer that sends your customers to a copy of your website. DNSSEC is switched on with whoever hosts your domain's DNS, and the NCSC covers it in its guidance on managing public domain names, alongside the domain settings further down this page. If you don't know whether it's on for your domain, that's a question for whoever looks after your DNS.

Why does DNS protection matter for UK businesses?

The government's Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses identified a breach or attack in the previous 12 months, and that phishing remained the most common type, reported by 38% of businesses. A phishing email usually wants one of two things from the person reading it: a click through to a page that steals a password or delivers malware, or trust in a message because it appears to come from someone they know. DNS protection deals with both, because filtering stops the click turning into a stolen password or an infected laptop, and domain controls make your own name harder to borrow.

The NCSC runs its own protective DNS service for the public sector and publishes separate advice for private businesses, which can't use it, on choosing a commercial service. Its view is that on a simple network, switching to protective DNS means changing which DNS service the network uses, for an immediate security benefit at very little set-up cost.

What DNS protection won't do is replace the rest of your security. It doesn't fix weak passwords, it can't stop someone who already has a colleague's Microsoft 365 login, and because it works mostly from lists of known dangerous domains, a brand-new scam site can get through until it's spotted. It works best as one layer alongside two-step verification, email filtering and devices that are kept up to date.

As an illustration, take a 25-person accountancy practice where most of the team works from home two days a week. An email that seems to come from a client links to a shared document, and the link leads to a fake sign-in page. With filtering on every laptop, that page is blocked at home as well as in the office, and the record of the blocked lookup shows which laptop clicked, so the practice knows whose inbox to check. Without it, the outcome rests on whether that one person spotted the fake.

Who controls your business domain?

Whoever holds the login at your domain registrar controls your domain, and with it your website and email. Every domain is registered through a registrar and managed through a login on the registrar's website, and that login can renew the domain, let it lapse, move it elsewhere or change where your email and website point. In small businesses it often belongs to a web designer from years ago or to someone who has since left, the renewal sits on a personal card, and nobody has looked at the settings since they were first set up.

The NCSC's guidance on managing public domain names recommends that more than one trusted person can manage the domain, that it's managed through your organisation's own systems rather than someone's personal login, and that it renews automatically on a payment method the business maintains. It also advises removing DNS records that point at services you no longer use, because a lapsed service at the end of one of those old records can be taken over by someone else and used to show their content on your domain.

How do you stop someone hijacking your domain?

Most domain hijacks start with the registrar login, so the best protection makes that login hard to get into and makes any change to the domain hard to push through. The NCSC recommends choosing a registrar that offers two-step verification and switching it on for everyone who can sign in, and the fewer people on that list, the better. Then ask your registrar about locks. A registrar lock stops the domain being transferred or its key settings changed until the lock is removed, and some domain endings also offer a registry lock, held by the organisation that runs the ending itself, which usually needs a manual check before anything can change. Locks can cost extra, so they matter most on the domain your email and website run on.

Moving a domain to another registrar needs a transfer code, sometimes called an authorisation or EPP code, or for .uk domains a change of IPS tag. Treat it like a password, request it only when you're deliberately moving the domain, and act straight away on any transfer request you didn't make.

Locks slow an attacker down, and monitoring tells you something is happening. The NCSC suggests watching your most important DNS records, such as the ones that point to your website and your email, for changes nobody expected, so a problem is spotted quickly rather than when customers stop receiving your emails. If the worst happens, speed matters, so learn your registrar's procedure for reclaiming a domain before you need it and keep the documents that prove your business owns it somewhere you can find them.

For the businesses we look after, we move the domain onto our servers and register it in the business's name, so the registration, DNS and renewals all sit with a team that answers. Transfers and setting changes are locked, any change goes through us, and we watch the domain's records for changes nobody planned. Our domains, email and hosting page explains how that works alongside your email and website.

How do you stop someone sending email in your name?

Three DNS records called SPF, DKIM and DMARC stop most attempts to send email in your name. Spoofing is when someone sends email that pretends to come from your domain, so your customers and suppliers see your name on an invoice or payment request you never sent. Those three records tell receiving mail servers which senders are allowed to use your domain and what to do with email that fails the check. The same records decide whether your genuine email reaches the inbox, which we cover in why business emails land in spam.

If you're not sure what your records say, our Email Health Check reads them for any domain and shows what's missing. We fix whatever it finds in your domain's public DNS records for £250 per domain, and can monitor them for £35 a month per domain, with no contract.

What should you look for in DNS protection for your business?

Good DNS protection follows your team rather than your office, so it should cover laptops at home and on other networks, and it should deal with encrypted DNS in browsers so nothing slips past it. Ask who maintains the list of allowed sites and how quickly they reply when a site is blocked by mistake, because a filter that blocks something your team needs, with nobody quick to unblock it, is the kind that gets switched off. On the domain side, someone should check that renewal, two-step verification, DMARC and DNSSEC are all set, and check again whenever you change a supplier.

We're a small senior team that works remotely for businesses of 5 to 200 people, wherever they're based. Our cyber security work blocks dangerous websites before they load, in the office or at home, with rules set by device or team. Cyber security is priced per project and sold on its own, and every client we've signed has stayed with us. Because everything is done remotely, we're the wrong fit if you need someone on site.

Check your DNS protection in ten minutes

These questions show where the gaps are.

• If someone in your team clicked a phishing link at home today, would anything stop the page loading?

• Do you know where your domain is registered, and can someone in your business log in today?

• Is two-step verification switched on for that login, and does the domain renew automatically on a company card?

• Does your domain have SPF, DKIM and DMARC records, and does anyone check them?

• Do you know whether DNSSEC is switched on for your domain?

• Would you know the same day if someone changed your domain's settings?

If you're unsure of two or more answers, your domain and your team's browsing are both worth a proper look.

The short version

DNS protection matters because so many attacks on small businesses start with a lookup, whether that's a click on a bad link or an email sent in someone else's name. Filtering every device, wherever your team works, closes the first gap, and keeping your domain's login, renewal and email records in order closes the second. If you do one thing this week, find out who can log in to your domain and whether your team's laptops are filtered when they're away from the office.

If you'd like dangerous websites blocked on every device your team uses, our Cyber Security page sets out what's included, how we set it up remotely and how it's priced.