DNS Security
TOORCE DNS Security inspects every DNS query that leaves the network. It validates DNSSEC, checks domains against threat intelligence and category policy, detects tunneling and DGA names, and records a full audit trail — before the local DNS server (Active Directory DNS or BIND) answers clients.
Use this section to understand the architecture, enable each protection engine, and read DNS Security logs.
In this section
| Topic | What you configure |
|---|---|
| Architecture | Traffic path, deployment modes, and where TOORCE sits relative to AD DNS / BIND |
| DNSSEC Validation | RRSIG, DNSKEY, DS validation and automatic root trust-anchor / KSK rollover |
| Threat Intelligence | Malware, phishing, C2, botnet, ransomware, and newly observed domains |
| DNS Filtering | Category blocks (gambling, adult, newly registered, dynamic DNS, and more) |
| Anti-Tunneling | Long/random subdomains, TXT abuse, encoded payloads, abnormal query patterns |
| Anti-DGA | Algorithmically generated domains used by malware |
| Anomaly Protection | Rate limiting, amplification, malformed DNS, NXDOMAIN floods |
| DoH/DoT Control | Block unauthorized DNS-over-HTTPS and DNS-over-TLS bypass |
| DNS Logging | Query fields, JSON examples, SIEM forwarding |
What TOORCE DNS Security does
DNS is the first lookup on almost every connection. If a client can resolve a malicious name, later HTTP/TLS filters see the session after the damage has started. TOORCE evaluates the name itself:
- Allow clean, policy-permitted domains (with DNSSEC status recorded)
- Block malicious, categorized, or anomalous names and return a sinkhole / NXDOMAIN / REFUSED response
- Log client IP, FQDN, query type, response IP, DNSSEC status, category, reputation, action, and reason
Web Security still inspects URLs after a connection starts. DNS Security is the earlier control point.
Recommended placement
Internet
│
▼
TOORCE Firewall — DNS Security
│ DNSSEC · Threat Intel · Filtering
│ Anti-Tunneling · Anti-DGA
│ Rate Limiting · DNS Logging
▼
Local DNS Server (AD DNS / BIND)
│
Local Clients
TOORCE can transparently intercept DNS on the path, or act as the resolver / forwarder in front of the local DNS server. Both modes are described in Architecture.