Stop phishing before anyone clicks.

Why

Before every click comes a lookup.

When someone clicks a link in a fake email, the computer first asks DNS: "where is mitid-update.info?". If DNS does not answer, the page never appears. The same goes for malware that needs to phone home.

Safe DNS is a list of known dangerous domains that is updated all the time. It works for every device on the network – including the printer, the TV and the guests’ phones – without installing anything.

The easy level

Three pairs of addresses.

1.1.1.1 · 1.0.0.1

Nothing – fast and private DNS
2606:4700:4700::1111 · ::1001

1.1.1.2 · 1.0.0.2

Known malware and phishing
2606:4700:4700::1112 · ::1002

1.1.1.3 · 1.0.0.3

Malware, phishing and adult content
2606:4700:4700::1113 · ::1003

Step by step

Five steps, about 5 minutes.

1. Choose a filter

   For an office: 1.1.1.2 and 1.0.0.2. For a home with children: 1.1.1.3 and 1.0.0.3.

2. Enter them in the router

   Find the DNS settings for the internet connection (WAN) in the router and replace the provider’s DNS with the pair. If you have IPv6, set the IPv6 pair too. Then every device gets the filter via the router.

3. Never mix the pairs

   If e.g. 1.1.1.2 is first and 1.1.1.1 second, devices use both in turn – and a phishing domain is blocked one moment and let through the next.

4. Bring the browsers along

   Chrome, Edge and Firefox can use encrypted DNS directly and bypass the router. Set them to the same filter: https://security.cloudflare-dns.com/dns-query (malware) or https://family.cloudflare-dns.com/dns-query (family). On Android: Private DNS = security.cloudflare-dns.com.

5. Test it

   Cloudflare has a test domain that is always on the malware list. With the filter on, it answers 0.0.0.0; without, it answers with a real address.

nslookup malware.testcategory.com

The answer should be 0.0.0.0 when the filter works.

Next level

Cloudflare Gateway: your own filter.

1.1.1.2 and 1.1.1.3 are ready-made lists with no settings and no log. Gateway – part of Cloudflare Zero Trust, free for up to 50 users – lets you choose categories yourself (e.g. newly registered domains, where much phishing lives), make your own block and allow lists and see in a log what was stopped.

1. Start the wizard

   Zero Trust → Traffic controls → Overview, and choose Protect a network with DNS filtering.

   

2. Name your DNS location

   Gateway suggests your public IP address so it can recognise your network. Then you point the router at the addresses Gateway gives you and choose the categories to block.

   

Honest about the limits

A filter – not a shield.

• Only known domains are stopped. A brand-new phishing domain can get through in its first hours.
• It can be bypassed by programs that use their own DNS or a fixed IP address.
• Cloudflare sees your DNS lookups. Whatever DNS provider you use does – choose one you trust.