DNS filtering blocks access to malicious domains by preventing devices from resolving them. When a device requests the IP address of a malicious domain (e.g., phishing site or malware server), the DNS service can block the query and return a safe response (e.g., a warning page or a generic error).
Services like Control D can help you get set up with DNS filtering in a few easy steps. If you’re new to Control D, don’t worry. This guide walks you through everything—from understanding what Control D is, to signing up, creating your first profile, and applying it to your network or devices.
By the end, you’ll have a powerful layer of protection that helps safeguard you against many forms of malware and malicious behavior online.
What Is Control D and How Does It Work?
Control D is a customizable DNS service that lets you shape what happens when devices on your network attempt to resolve domains. Instead of returning an IP address for every request, Control D can selectively block known malicious domains. By doing so at the DNS level, it stops dangerous connections before they even begin.
This approach is proactive, lightweight, and doesn’t rely on software installation on your end devices.
How to Use Control D’s DNS Resolvers to Protect Against Malware
Step 1: Create an Account
- Visit the Control D website and navigate to the sign-up page.
- Enter a valid email address and create a strong password.
- Click “Sign Up”.
- Confirming Your Email and Logging In:
- Check your email inbox for a confirmation message from Control D. Click the verification link provided. Once verified, return to the Control D website and log in using the credentials you set during registration.
2. Open the Control D Dashboard
Upon logging in, you’ll arrive at the Control D Dashboard. Here, you’ll see navigation elements that let you access various features:
Profiles/Policies
Where you create and manage DNS filtering settings.
Logs/Reports
Where you can review DNS queries, blocked requests, and statistics.
Settings/Account Management
Manage your account details, API keys, and support tickets.
Profiles
Think of a Profile as a set of rules for DNS filtering. You can have multiple Profiles for different devices or groups. A Profile is a bundle of policies (i.e., filters) that determine what domains get blocked, allowed, or redirected.
For malware protection, you’ll enable Control D’s malware blocklists, ensuring any domain known to host malicious code is denied at the DNS level.
Click the “Add Profile” button and assign a descriptive name to your profile, such as “Malware Protection.”
Save the Profile to begin customizing its settings.
Step 3: Add Your Filters
After you hit create, the next screen will prompt you to add Filters that you’d like to block. Filters are categories of websites, Control D maintains lists of malicious domains associated with malware, phishing, and command-and-control (C2) servers to keep you safe.
Enabling the Malware Blocklist:
- Within the profile settings, locate the “Blocklists” or “Filters” section.
- Look for a category labeled “Malware” or “Security Threats.”
- Enable the toggle or checkbox for the malware blocklist.
- Save your changes. You’ve now instructed Control D to block known malicious domains.
Beyond malware, Control D offers other categories too, such as:
Phishing and Scam Sites
Block domains commonly used to trick users into sharing sensitive information.
New Domains
Zero-day attacks are generally launched from domains registered in the past month. Control D can guard against them.
Unsafe Downloads/Filesharing
Stop sites known for distributing questionable software.
Enable any categories that align with your security goals. Your Profile will save automatically after changes are made.
Step 4: Integrate Control D With Your Network
For maximum security, we recommend using Control D at the router level. For this, you’ll need to set your router’s DNS to Control D’s resolvers.
After selecting the router type, add a name, and click ‘Create Endpoint’ at the bottom right of your screen.
You should see a confirmation screen like this:
There are two main ways to configure Control D on your router. Log into your router’s admin interface (usually accessed by entering something like 192.168.1.1 in your browser).
- Locate DNS settings, often under “Internet” or “WAN” settings.
- Replace the default DNS servers with the Control D DNS addresses provided on the dashboard.
- Save and apply the changes. Once your router reboots or updates its configuration, all connected devices will inherit these filtered DNS settings.
For a more customizable experience, consider installing the ctrld DNS daemon - instructions for this will be given directly in the Dashboard after clicking the Help Me Configure button.
Configuring Individual Devices (Laptops & Phones)
To install Control D on your Android, iOS, or MacBook, start by selecting ‘Client’.
Next, select your platform from the drop down list.
The step-by-step instructions after you select ‘Create Endpoint’ will help you install the resolver on your favorite platform. We’ve included instructions for Windows and macOS below:
Step 5: Fine-Tuning Your DNS Policies
Maybe you know of specific domains you want blocked, even if they’re not on Control D’s built-in lists. For this, you’ll need to add custom blocklists:
- Go to your Profile’s “Custom Rules” section.
- Enter the domain(s) you wish to block.
- Save the changes and these domains will no longer resolve on your network.
Step 6: Adjusting and Refining Your Configuration
As you become more comfortable with Control D, you may want to adjust your configuration:
Add or Remove Blocklists
If you find that too many legitimate sites are being blocked, consider removing some categories or using a less aggressive blocklist. Conversely, if you notice a particular type of threat slipping through, add a specialized list.
Use Allowlists
Sometimes, benign sites get caught in the filtering net. If you trust a site that’s being blocked, add it to an allowlist with Custom Rules. This tells Control D to always allow that domain, overriding the blocklists.
Time-Based Rules
Control D allows time-based policies. For example, enable these settings if you want stricter filtering during work hours and more lenient settings afterward.
Monitor for False Positives
If you notice certain services you need are blocked, tweak your Profile. Avoid turning off your malware protection entirely—just allow specific known-good domains.
Integrate with Other Security Tools
DNS filtering is just one layer of defense. Use it alongside antivirus software, firewalls, and possibly VPN solutions. The combination of these layers makes it harder for malware to find a way in.
Stay Informed
Keep an eye on Control D’s announcements, blog posts, and user community. If they roll out new features—such as enhanced phishing detection or improved cryptomining blocking—consider integrating these improvements into your profile.
Benefits of Using Control D for Malware Protection
Preventing Initial Infection
If a malicious website is blocked at the DNS level, your device never has the chance to download malware.
No On-Device Overhead
Unlike traditional antivirus software, DNS filtering won’t consume CPU or memory on your devices.
Centralized Management
All your DNS policies can be managed from a single dashboard, making it easy to implement changes network-wide.
Scalability
Whether you’re a single user or an organization with many employees, you can expand Control D’s protections as needed.
In Summary
Setting up Control D to block malware involves understanding how DNS filtering works, choosing the right plan, configuring your profiles, integrating at the router or device level, and continually monitoring and refining your policies. Although the process might sound technical, Control D’s user-friendly dashboard and clear categories make it approachable, even for individuals who aren’t IT professionals.
By following the steps outlined above, you can confidently deploy DNS-based malware protection in your home or business environment. The result is a more secure browsing experience, with malicious domains and harmful content blocked before they can cause any damage.
