Threat prevention
DNS security
Block malicious domains, command-and-control callbacks and DNS tunnelling at the first lookup.
DNS security checks domain lookups and blocks those that lead to threats. Nexapp blocks malicious and newly registered domains, command-and-control callbacks and DNS tunnelling, so many attacks fail before a connection is even made.
What it does
Almost every connection starts with a DNS lookup, including the ones malware makes. Phishing sites, command-and-control servers and freshly registered attack domains all have to be resolved first. DNS can also be used to smuggle data out in small encoded queries that many firewalls ignore. DNS security turns that first step into a checkpoint. It checks each lookup against threat intelligence, blocks known-bad and newly registered domains, and catches patterns that look like tunnelling. Blocking at this stage is cheap, and it works for any device that makes a DNS query.
How it works in Nexapp
Domain reputation
Lookups to malicious domains and command-and-control servers are blocked before a connection is opened.
Newly registered domains
Domains that appeared only recently, a common sign of phishing campaigns, can be blocked by policy.
Tunnelling detection
DPI on Nexapp edges detects DNS tunnelling and data-exfiltration patterns hidden in DNS traffic.
Covers devices without agents
Printers, cameras and IoT devices that cannot run security software are still protected, because their lookups pass through the platform.
Where teams use it
IoT-heavy sites
Cameras, sensors and controllers behind branch routers are stopped from calling out to command-and-control servers.
Phishing defence in BFSI
A bank blocks newly registered and malicious domains used in phishing campaigns against its staff.
Quiet data exfiltration
A pharmaceutical company catches DNS traffic patterns that suggest data being moved out through encoded queries.
Frequently asked questions
Why add DNS security if we already have a web gateway?
DNS security acts before a connection is made and covers every device, including those that never use a browser.
The SWG then inspects the web traffic that is allowed.
What is DNS tunnelling?
It is a technique that hides data or commands inside DNS queries and responses.
Nexapp detects these patterns with DPI on the edge.
Does DNS security cover remote users?
Yes. Threat prevention runs under one policy, so remote users on the InstaAccess client get the same DNS protection as branch users.
Related capabilities
- Secure Web Gateway (SWG)Safe internet access for every user, whether at a branch, at home or on the road.
- IoT/OT securityFind every device behind your routers, segment it, and let it talk only to what it needs.
- Agentic threat preventionLet AI connect the threat signals and propose the block, with people approving where it matters.
- All capabilitiesEvery capability in the Nexapp SASE platform.
See DNS security on your own sites.
24×7 NOC in Pune · 75,000+ devices deployed · 400+ enterprise and banking customers since 2014.