DNS Security for Small Business: The Cheap Layer Most MSPs Skip

DNS security for a small business comes down to one cheap, high-leverage control: protective DNS. It checks every domain your computers try to reach against threat intelligence and quietly blocks the bad ones, which stops a large share of malware callbacks, phishing redirects, and data theft before anything lands on an endpoint. It costs a few dollars per user per month, takes an afternoon to deploy, and most managed IT shops still leave it off.

What DNS actually does, in one paragraph

Every time a device opens a website, sends email, syncs a file, or phones home for an update, it first asks a DNS resolver to turn a name like example.com into an IP address. That lookup happens hundreds of times a day per person, almost always invisibly. The problem is that the default resolver, usually your ISP's, answers every question honestly. It will resolve a known ransomware control server or a freshly registered phishing domain just as cheerfully as it resolves your bank. Protective DNS changes the answer.

What protective DNS is

Protective DNS, sometimes shortened to PDNS, is a resolver that applies policy before it answers. Instead of blindly returning an IP, it checks the requested domain (and often the IP it would return) against threat intelligence, and refuses to connect to known or suspected malicious sites. The NSA and CISA describe this plainly in their joint guidance, Selecting a Protective DNS Service, where they call it a policy-implementing resolver using Response Policy Zone functionality. In plain English: a domain on the blocklist gets a dead end instead of a connection.

The mechanics matter because they explain the coverage. The malicious site does not have to be a website your user clicks. It can be a callback address baked into malware, a tracking pixel in a phishing email, or a domain a compromised laptop uses to ship your files out. All of it starts with a DNS lookup, and that is the choke point protective DNS sits on.

Why it stops more attacks than its price suggests

Three attack stages run through DNS, and a good filter touches all three.

Malware command and control. After an attacker gets a foothold, the malware needs to reach its operator to receive instructions and stage the next move. That beacon is a DNS lookup. Block the domain and the infection is loud, isolated, and far less useful to the attacker.

Phishing delivery. The FBI's Internet Crime Complaint Center logged phishing and spoofing as the single most reported crime type in its 2024 Internet Crime Report, with 193,407 complaints, inside a year that set a record $16.6 billion in reported losses. A large slice of those campaigns rely on lookalike domains that were registered hours or days before the email went out. Protective DNS services that categorize newly registered and low-reputation domains can blackhole the link even when an employee clicks it.

Data exfiltration. Attackers tunnel stolen data out over DNS itself, encoding records to slip past firewalls that trust port 53. A resolver watching query patterns can flag and cut that channel. The same applies to the simpler case of a workstation quietly uploading files to an attacker-controlled domain.

The layer most MSPs skip, and why

Most small businesses buy a firewall, antivirus, and maybe email filtering, then assume DNS is handled because the internet works. It is not handled. The firewall sees traffic after the connection is attempted; protective DNS prevents the connection from being attempted at all. Endpoint software catches the malware that already executed; DNS filtering can stop the download or the callback that the malware depends on.

I think the reason it gets skipped is unglamorous. It is cheap, so there is little margin in selling it as a product, and it is invisible when it works, so nobody asks for it. That is exactly backward. The controls with the best return are usually the quiet ones. Protective DNS maps cleanly onto the Protect and Detect functions of NIST Cybersecurity Framework 2.0, and it is one of the few additions that improves both at once for a flat, predictable cost.

Encrypted DNS: the part that complicates things

There is a wrinkle worth understanding. Modern browsers and operating systems increasingly use encrypted DNS, DNS over HTTPS or DNS over TLS, which is good for privacy on public networks but can quietly route lookups around your company resolver. If Chrome is resolving names through a public encrypted resolver, your protective DNS policy never sees those queries and never gets to block anything.

The fix is to make your protective resolver the only sanctioned path and block the bypass. NSA and CISA's guidance is explicit about hardening internal resolution and blocking traffic to unauthorized DNS-over-HTTPS servers. On a managed fleet this is enforced through device policy: point endpoints at the protective resolver, disable application-level DNS in the browser, and block outbound DNS to anything else. Encrypted DNS and protective DNS are not in conflict. You want both, with the encryption terminating at a resolver you control.

How we deploy it at EFROS

For our trucking and logistics clients, and for any small business we run, protective DNS is a default, not an upsell. We push the resolver to every managed endpoint through Microsoft Intune and Conditional Access so a laptop is protected on the office network, at a truck stop, and at the driver's kitchen table. We block outbound DNS to unauthorized resolvers so the policy cannot be quietly bypassed. The block logs feed our 24/7 SOC, because a workstation hammering a known control domain is an early warning, not just a blocked page.

That last point is the one people miss. The value is the visibility, not just the block. When our analysts see a device repeatedly trying to reach something it should not, that is a thread to pull before it becomes an incident. For a freight operation where a hijacked email account can reroute a load or redirect a factoring payment, catching the callback early is the difference between a near miss and a loss.

What it costs and how to start

Protective DNS runs a few dollars per user per month, which is rounding error next to the price of a single ransomware recovery or a redirected wire. You can deploy it in an afternoon. The honest work is not the resolver, it is the hardening: getting every device pointed at it, killing the bypass paths, and actually reading the logs. That is the part a small team rarely has time for, and the part that turns a cheap filter into real coverage.

If you want this set up and watched rather than just switched on, that is exactly the kind of unglamorous, high-leverage work we handle. See the EFROS Chicago cybersecurity services page for how we run protective DNS as part of a managed stack, or call us at +1-765-888-8888.