Overview

SafeDNS Shield is an on-premises web filtering and security solution that operates as a DNS proxy. It processes every DNS query to identify the requesting user, evaluates the queried domain against that user’s filtering policy, and then allows or blocks the request.

When a domain is blocked, the proxy resolves it to the IP address of a block page instead of returning the actual IP. The block page can be a custom corporate page hosted outside the solution, or the default block page built into SafeDNS Shield, which can also be customized.

Note: For the built‑in block page, you must add the SafeDNS root certificate to the trusted certificate store on every end‑user device in order to display the block page over HTTPS. Without the certificate, blocked HTTPS requests will not show the block page, but access to the resource is still denied. Displaying the block page over HTTP does not require the certificate.
If you use an externally hosted block page, certificate requirements depend on your own hosting configuration.

If a domain is allowed, the proxy forwards the DNS request to the next server in the resolution chain. This server can be a local corporate DNS server, an ISP’s caching DNS resolver, or any public DNS service (for example, Google Public DNS or Cloudflare).

Because SafeDNS Shield inspects all DNS traffic, it enables comprehensive, per‑user traffic analysis. Every request is logged, providing access to detailed statistical information.