DNS Security

Stopped before the connection starts

Every computer asks DNS "where is this site?" before it connects. When Uplivra's DNS server answers that question, it can refuse to answer for a bad site. The computer never connects, so nothing downloads and no password is typed into a fake page.

Blocked by default:

• Malware: sites that spread malware or control infected computers.
• Phishing: fake sign-in pages.
• Scams and fraud: fake shops, fake support, investment scams.
• Ransomware and crypto mining in the browser.
• Bad networks: answers that point into networks run by criminals (Spamhaus DROP), even for a name no list knows yet.

Categories you choose

Each policy can also block:

• adult, gambling, social networks, games, video streaming;
• advertising and trackers.

Policies apply by network: guests, staff and the warehouse can each have their own. Every policy has its own allow list and block list.

What lists miss

Lists only know yesterday's sites. Uplivra also looks at the name itself:

• Newly registered domains: most attacks use domains a few days old. Warn or block domains registered in the last 30 days.
• Machine-made names: malware makes random-looking names to find its control server. Uplivra scores each name; warn or block the ones that look made by a program.
• DNS tunnelling: data hidden inside hundreds of long one-off names. Uplivra watches each device and warns or blocks.

Start with warn: nothing is blocked, and the log shows what would have been.

No way around it

Browsers and phones can use their own encrypted DNS and skip yours. With Stop going around this DNS server on:

• Firefox's check name is answered "doesn't exist", so Firefox uses your DNS.
• iCloud Private Relay is turned off on your network.
• Known public encrypted-DNS services don't resolve. Uplivra gives you the list to block on your firewall too.

SafeSearch can be forced for Google, Bing, YouTube and DuckDuckGo.

Away from the office too

Laptops and phones can use your Uplivra server's encrypted DNS at home and on the road, with the same policy, log and alerts. Uplivra makes the settings for Windows 11, Mac, iPhone, iPad, Chrome, Edge and Firefox; a lost device is turned off with one click.

See what was stopped, and why

• The security log: every block and warning, with the device, the name and the reason. It is kept even when the full query log is off.
• Allow it: one click from the log adds a name to a policy's allow list.
• Alerts: a device that keeps reaching for malware or phishing raises an alert. Your alert rules can open a ticket.
• Your SIEM: send the security log to syslog, Splunk or an HTTPS collector with log forwarding.

Blocked HTTPS sites show the browser's normal "can't reach this site" page. A friendly block page would need Uplivra's certificate on every computer, which we don't do. The log and the alert say what was stopped.

Where the lists come from

Uplivra uses lists whose terms allow commercial use, downloaded every day by your Uplivra server:

• The Block List Project (Unlicense)
• UT1 blacklists, Université Toulouse Capitole (CC BY-SA 4.0)
• Spamhaus DROP (credit: The Spamhaus Project)
• StevenBlack hosts (MIT) and 1Hosts (MPL-2.0)
• WhoisDS newly registered domains

You can add any list you are allowed to use, by its web address. Your DNS upstream (Quad9 by default) blocks known threats as well.

Price

$1 per protected device per month (price under review). Count the laptops, PCs, phones and tablets that use Uplivra's DNS server. The DNS server itself is free in Core.