Frequently
Asked
Questions

FAQs | DNS Firewall

• How do I find the IP addresses of my DNS Servers for DNS Firewall?

  Log into your server and run the following command(s):

  • curl -4 https://deteque.com/whatsmyip/
  • curl -6 https://deteque.com/whatsmyip/

  The result from these commands will provide you with the IP that you need to enter into our Customer Portal under the Access tab of your DNS firewall settings.

  Please note that if you have multiple servers pointing to our services, you will need to run this command on each server that you will be pointing to our service.

  Once you have entered the IP addresses, it can take up to one hour to be provisioned in our systems.

• What are DNS Firewall Threat Feeds?

  DNS Firewall Threat Feeds are Response Policy Zones (RPZs) that provide automatic protection against phishing sites and malware downloads.

  They are delivered in industry standard RPZ format which allows a recursive DNS resolver to choose specific actions to be performed. This includes dropping, blocking, and passing through traffic.

• What error does the DNS resolver return when a site gets blocked?

  A DNS resolver will return an NXDOMAIN (invalid domain) response when it is matched against a threat feed listing.

  Those utilizing the Dedicated Service can point to an internal IP resource that will allow the block to redirect to an information page that can provide a warning, some education, or insight into why something was blocked.

• What hardware and software do I need to support DNS Firewall Threat Feeds?

  If you chose to use Spamhaus’ Managed Service this is not an issue. However, where you are running your own DNS infrastructure and want to use our Dedicated Service, here are our recommendations:

  While it is possible that the current hardware that is running your DNS resolver may be able to handle the processing of DNS Firewall Threat Feeds, we recommend the following hardware configuration:

  8 core CPU

  8 gigabytes of RAM

  Bare-metal dedicated server

  Please ensure that you are running the most up-to-date version of your resolver software.

• Why would I want to block DNS resolution?

  There are many networks, domains, and IP addresses on the internet whose sole purpose is to cause harm to or steal information from unsuspecting users who visit their servers and sites.

  For example: a phishing domain, created for the sole purpose of stealing data, can be used for a spam campaign that is sent to users on your network asking them to verify their account. The email is received and is not blocked by your spam filtering, so the message gets delivered into your user’s inbox. When the user clicks on the link to verify their account, because the site is listed in the Threat Feeds, their computer is unable to resolve the phishing website.

  This action will protect your user from surrendering their personal information, and potentially prevent their workstation from becoming infected with botnet software. Blocking malicious content also offers you the potential to educate your users immediately.