Every time someone in your office clicks a link, their computer quietly asks a question before the page appears: where on the internet does this name live? The answer comes from a DNS server, which works like the internet’s phone book. It takes a name like yourbank.com and returns the numbered address the computer actually connects to.
DNS filtering puts a check on that lookup. Before the address goes back, the name is compared against lists of sites known for phishing, malware or scams, and against the categories you’ve chosen to block. If it’s on the list, the browser gets a block page instead of the site, and nothing from the bad site ever loads.
Why it helps a small office
Most attacks on a small office need someone to visit a web page at some point. A link in an email opens a fake Microsoft sign-in, or a search result leads to a download that isn’t what it says. Training teaches people to spot these, and it should keep happening. But training asks each person to make the right call every time, on a busy afternoon, on the fortieth email of the day.
Filtering makes the call earlier, without asking anyone. The employee who would have clicked sees a block page, and the attempt goes on a report your IT provider can look at.
What it doesn’t catch
It’s worth knowing the limits, because a provider who sells it as complete protection is overselling.
- New sites. A phishing page put up an hour ago may not be on anyone’s list yet. Some filters block very newly registered names by default for this reason.
- Real sites that have been compromised. If a legitimate site is serving something bad, the name looks fine.
- Content. DNS filtering decides which names can be reached. It doesn’t read the page or scan the file. That’s the job of email filtering and endpoint protection.
- Laptops away from the office. If the filtering only lives on the office router, it stops the moment someone works from home or a coffee shop. It needs to be set on the device, or delivered through a service that follows the user.
- People going around it. Browsers can use their own encrypted lookups that skip the company’s filter unless that’s been locked down.
None of that makes it less worth having. It’s one layer, and it’s cheap compared with most of the others.
Training asks each person to make the right call every time, on a busy afternoon, on the fortieth email of the day.
The password manager connection
One small detail makes a company password manager a natural partner here. A password manager fills in a password only on the exact site it was saved for. On a convincing fake of your Microsoft sign-in page, it stays empty. For a lot of people, that pause (“why didn’t it fill in?”) is the moment they notice something’s wrong.
A password manager also ends the habit of using the same password everywhere, which is how one leaked password from a shopping site turns into access to someone’s work email.
Five questions for your IT provider
If you’re not sure what you have, these questions will tell you quickly:
- Do we have DNS or web filtering, and does it work on laptops outside the office?
- Can staff turn it off or go around it?
- Who reads the reports of what was blocked, and how often?
- If a site we need is blocked by mistake, how fast can it be unblocked?
- Do we have a company password manager, and does everyone use it?
If the answer to the first one is “the firewall in the office does that,” ask about the second half of the question.
How we handle it
For our Managed IT customers, web filtering is part of a layered cybersecurity setup. We use Microsoft Entra Global Secure Access to put identity-based rules and web filtering between your people and the sites and apps they use, in the office or out of it, and we pair it with a company password manager, email filtering and endpoint protection. If you want to know which of those layers you have now, our free technology review checks them and gives you a written report.