DNS Filtering
Protective DNS — block malicious and unwanted domains for your users before the connection is ever made. This is separate from DashXDNS, which is authoritative DNS hosting and failover for your own domains.
Open it at Secure Access → DNS Filtering. It is a paid add-on, available on the Starter plan and above.
DNS Filtering is served today from resolvers in the United States (East and West). Filtering itself is identical wherever you are — the same policy, the same feeds — but a client in Europe pays the round trip across the Atlantic on lookups that are not already cached, typically 80–100 ms. European resolvers are planned; they are not deployed yet, and this page will say so when they are.
Read the dashboard
Pick a time range at the top — All, 7d, 30d or 90d — or click Export CSV to download the same data.
| Tile | What it counts |
|---|---|
| Queries blocked | Total blocked lookups in the range. Click it for the full list |
| Blocked domains | How many distinct domains were blocked |
| Would block · N domains | Appears only when a policy is in Monitor mode — what would have been blocked. Nothing was actually stopped |
Most blocked
The list under the tiles shows the top offenders. Each row carries a reason badge:
- Threat — matched a malware/phishing feed
- Category — matched a category you switched on
- Your rule — matched one of your own deny rules
The device counter turns red when a threat domain was hit by more than one device — that is a sign of something spreading, not one person clicking a bad link. Click any row to see which devices, users and source IPs hit it.
The two charts
They answer different questions, so read them together:
- Blocks per day — the raw volume: every hit that was actually blocked. This is the number to quote when someone asks how much the filter is doing.
- Security events per day — incidents, not hits: a domain seen for the first time, a sharp escalation, or a return after a quiet spell. One machine beaconing 4,000 times to the same C2 is one event, which is why this chart stays readable when the volume chart spikes.
A tall bar on the volume chart with a flat events chart means more of the same, already-known traffic. A spike on the events chart is the one worth opening.
Both start collecting from the day the feature shipped — earlier blocks were counted without a timestamp, so there is nothing to chart before that.
Check a domain
Before arguing with a user about why a site is blocked, look it up:
- Type the domain into Check a domain, e.g.
example.com. - Click Check.
You get a verdict badge (BLOCKED or ALLOWED), the reason, which of your rules matched, and the category listings the domain appears in. If it is in no list at all you see "Not listed in any category or threat feed."
Threat & category feeds
The table at the bottom shows every feed DashX syncs — Feed, Type, Entries, Last sync, Status. Use it to confirm data is fresh before blaming a rule.
Reading the status column
| Status | Meaning |
|---|---|
ok | Downloaded and parsed normally |
ok: … | Parsed, but with a note worth reading — for example a suspicious drop in entry count, in which case DashX keeps the previous data rather than shrinking a category |
mismatch: … | The source published a different category than the one requested. The data is still loaded — those domains are genuinely malicious — but the label cannot be trusted. Real example: the archive named malware.tar.gz contains a directory called phishing |
error: … | The download or the parse failed; the previous data stays in place |
A feed stuck on error for more than a day is worth reporting. A mismatch is not something you can fix on your side — it is a note that the upstream source changed what it publishes.
Why some threat lists look small
A domain-level block is blunt: it takes out the whole site, not one bad URL. Most malware URLs sit on legitimate websites that were hacked, so a feed that blindly blocked every host would take down your customers', suppliers' and partners' sites along with the threat.
DashX therefore excludes hosts the source itself flags as compromised, and drops indicators the source is not confident about. That is why a threat category may hold a few hundred entries rather than tens of thousands — the missing ones are mostly domains it would have been wrong to block.
Sources and licences
| Source | Used for | Licence |
|---|---|---|
| Université Toulouse Capitole | Content categories and part of the threat data | CC BY-SA — attribution required, which this page provides |
| abuse.ch URLhaus | Sites actively distributing malware | abuse.ch Terms of Use |
| abuse.ch ThreatFox | Botnet command-and-control, and malware delivery — kept as two separate feeds so a block tells you which one it was | abuse.ch Terms of Use |
| DashX curated | AI / GenAI services | Maintained by DashX |
Where to go next
- Policy — switch categories on, choose Block or Monitor, set SafeSearch and schedules
- Custom rules — your own allow/deny list
- User & Group Policy — different rules for different people
- Agent DoH — the easiest way to cover laptops