In short
DNS filtering blocks or allows whole domains at the lookup, before any connection, for every app on the device. URL filtering inspects the full web address, and often the content, through a proxy or secure web gateway, so it can block single pages and files. DNS filtering is the lighter first layer; URL filtering adds precision where you need it.
Want an impartial recommendation?
Tell us about your users, systems and priorities and we will tell you which option fits, and why.
The difference in one example
Take the address https://files.example.com/shared/report.pdf.
A DNS filter only ever sees the name files.example.com, because that is all the device asks the resolver about. It can allow or block that whole name, and nothing more. It does not see /shared/report.pdf, the search terms in a query string, or the file that comes back.
A URL filter sits in the path of the web traffic itself, usually as a proxy or secure web gateway. It sees the full address, can decide differently for /shared/report.pdf and /shared/holiday.jpg on the same domain, and, with HTTPS inspection, can scan the content and files.
That is the whole trade-off in miniature: DNS filtering is simple, fast and covers every application, but it is coarse. URL filtering is precise but heavier, and only covers the traffic that passes through it. For the broader comparison of DNS filtering with web filtering in general, see DNS filtering on our Cloud Security site.
DNS filtering vs URL filtering compared
| DNS filtering | URL filtering (proxy or secure web gateway) | |
|---|---|---|
| What it sees | The domain name being looked up | The full URL, and with HTTPS inspection the page and file content |
| When it acts | Before any connection is made | As the web request is made |
| What it covers | Every application and protocol that uses DNS | Web traffic routed through the proxy, usually HTTP and HTTPS |
| Block one page on a site | No: the whole domain or nothing | Yes |
| Inspect downloads | No | Yes, with HTTPS inspection |
| See search terms | No | Yes, with HTTPS inspection |
| Connections straight to an IP address | Not seen | Seen if routed through the proxy |
| Root certificate on devices | Only to show HTTPS block pages without warnings | Needed for HTTPS inspection |
| Performance and privacy impact | Light: only lookups are handled | Heavier: traffic is decrypted and inspected |
| Typical deployment | Change network DNS; roaming client on laptops | Agent, PAC file, tunnel from the firewall or SASE client |
Neither is better in every case. They are layers, and most mature set-ups use DNS filtering everywhere and URL filtering where the extra precision is worth the extra weight. DNS-layer security explains why the DNS layer makes such a good first control.
Still not sure which way to go? Ask us
Tell us what matters most to you and we will recommend one, with the trade-offs explained.
A worked example: Cisco's three layers
Cisco's DNS security range is a useful illustration because it offers all three levels in one family. Forever Systems is a Cisco Partner, and the details of each package live on our specialist sites; this is just the layering:
| Layer | What happens | Where it is in Cisco's range |
|---|---|---|
| 1. DNS layer | Every lookup is checked against Cisco Talos security categories and your content categories; good domains resolve, bad ones are blocked | Umbrella DNS Security Essentials; Secure Access DNS Defense Essentials |
| 2. Intelligent proxy for risky domains | For a list of grey domains that host both good and bad content, the DNS answer points to Cisco's proxy, which checks the full URL and can inspect files; everything else goes direct | Umbrella DNS Security Advantage and the SIG packages; Cisco also lists selective proxying for Secure Access DNS Defense |
| 3. Full secure web gateway | All web traffic goes through a cloud proxy with TLS decryption, URL and content filtering, file-type blocking and malware scanning | Umbrella SIG; Cisco Secure Access Secure Internet Access |
The intelligent proxy is the interesting middle ground: it gives URL-level decisions for the small set of domains where they matter, without proxying all your traffic. It needs the Umbrella root certificate on devices to inspect HTTPS. For the full picture, see our guides to Cisco DNS-layer security and the Umbrella secure web gateway.
SafeSearch, HTTPS and certificates
Some things that look like URL filtering can be done at the DNS layer.
SafeSearch. Search engines publish special addresses that force safe search. A DNS filter can answer lookups for the search engine with that address, so filtered results are enforced without a proxy. Cisco Umbrella, for example, enforces SafeSearch through DNS for Google, YouTube and Bing; Umbrella's content filtering page covers the detail. This is popular with schools.
HTTPS block pages. When a DNS filter blocks an HTTPS site and sends the browser to a block page, the browser expects the real site's certificate and may show a warning. Installing the provider's root certificate lets the block page display cleanly. The NCSC notes this certificate trade-off in its protective DNS guidance; see DNS sinkhole for the alternatives.
HTTPS inspection. Full URL filtering of HTTPS traffic means the proxy decrypts it, checks it and re-encrypts it, which needs a trusted root certificate on every device and exceptions for sites that break or that you choose not to inspect, such as banking and health. Without inspection, a proxy or firewall can often see only the domain name from the TLS handshake (the server name indication).
Encrypted Client Hello. Newer TLS features encrypt that server name too, which reduces what a firewall can see without full inspection. DNS filtering still sees the lookup as long as devices use your resolver. See Encrypted Client Hello.
Weighing up the options?
We can compare them against your own requirements and give you a straight answer.
When DNS filtering alone is enough, and when it is not
DNS filtering on its own is usually enough when:
- your main aim is to stop phishing, malware and command-and-control domains for every device
- you want a light acceptable use policy by category, such as blocking adult content or gambling
- you need something quick to deploy across many sites, guest networks and roaming laptops
- you do not want to decrypt staff traffic
Add URL filtering, through a secure web gateway or SASE platform, when:
- you need to allow a site but block parts of it, or block specific files and file types
- you need to inspect downloads and uploads, or apply data loss prevention to web traffic
- you need to see search terms or page-level activity, as schools often do for safeguarding
- you need cloud app controls beyond allowing or blocking a domain
Schools are the clearest case for both. The Department for Education's filtering and monitoring standards and the UK Safer Internet Centre's appropriate filtering definition go beyond domain blocking, so many schools combine DNS filtering with page-level filtering and monitoring. See web filtering for schools.
How we help
We supply DNS-only services, endpoint and firewall DNS add-ons, and full secure web gateway and SASE platforms, so we can recommend the layer you actually need rather than the heaviest one. Our DNS security solutions page compares the options.
Contact us to talk through what you need to block, where your users work and whether HTTPS inspection is right for you, and ask us for a quote.
How Forever Systems helps with DNS security
We are an independent UK IT and cyber security provider and a Cisco Partner. We supply Cisco Umbrella and Cisco Secure Access DNS Defense, and a range of other DNS filtering options, so we can recommend what fits rather than one answer for everyone.
- Start with what you have: we look at your firewall, endpoint protection and Microsoft 365 licences first, as some already include DNS or web filtering
- Choosing a service: Cisco DNS-layer security, DNS filtering bundled with endpoint protection, or a protective DNS service from the public sector, compared in plain English
- Set-up and roll-out: network forwarding, roaming clients for laptops off site, policies, block pages and controls to stop encrypted DNS bypassing the filter
- Migration help, including planning a move from Umbrella DNS packages to Cisco Secure Access DNS Defense
- Ongoing help: policy changes, reporting reviews, licence management and renewals, agreed at quote
We work with businesses, schools, charities and public sector organisations.
Frequently asked questions
What is the difference between DNS filtering and URL filtering?
DNS filtering decides whether a device may resolve a domain name, so it blocks or allows whole domains before any connection. URL filtering checks the full web address, and often the content, through a proxy or secure web gateway, so it can treat individual pages and files differently.
Can DNS filtering block one page on a website?
No. A DNS filter only sees the domain name, so it can block the whole domain or nothing. To block a single page or path on an allowed site, you need URL filtering through a proxy, secure web gateway or an intelligent proxy for selected domains.
When do I need a proxy?
When you need page-level decisions, file inspection, data loss prevention, visibility of search terms or detailed cloud app controls. A proxy or secure web gateway gives those, usually with HTTPS inspection and a root certificate on each device.
What is URL filtering?
URL filtering allows or blocks web requests based on the full address, such as a specific page, path or file, usually by category. It runs in a proxy, secure web gateway or firewall that sits in the path of the web traffic.
Is DNS filtering faster than URL filtering?
DNS filtering adds very little work because only lookups are checked, and it does not touch the traffic itself. URL filtering, especially with HTTPS inspection, handles every web request and needs more processing, which is why many organisations use DNS filtering everywhere and URL filtering where it adds value.
Still deciding?
Ask us and a member of our team will reply by email with a straight answer.