Is DNS filtering worth it for SMBs?

DNS filtering is not magic, but it is one of the highest-return security controls for small offices that will not tolerate heavy-handed web proxies. You are not inspecting every byte of HTTPS traffic. You are refusing to resolve domains that host malware, phishing kits, command-and-control, and a lot of garbage nobody needs on a work network.

The question is not “should we filter DNS?” For most SMBs, the answer is yes. The question is what you expect it to do—and what you still need beside it.

What you actually get

A DNS filter (Cloudflare Gateway, Cisco Umbrella, Quad9 for a bare-minimum posture, or similar) sits between clients and the internet’s phone book. When a laptop tries to reach a known-bad hostname, the resolver returns nothing useful. The click still happened; the infection often does not.

Good fits:

• Blocking commodity malware and phishing before the page loads
• Stopping some credential-stuffing and scam domains without a full SWG appliance
• Giving you a log of “who tried to reach what category” for incident triage
• Extending policy to laptops off the office LAN if the agent or DoH profile travels with them

Do not expect:

• Full visibility into encrypted traffic contents
• Protection when someone disables the filter or uses their own resolver
• A substitute for MFA, patching, or endpoint detection on endpoints that leave the building

When it is worth the spend

DNS filtering earns its line item when:

• Staff browse the open web for work and you have no other web security layer
• You have had “someone clicked something” tickets and want fewer repeats
• Compliance or cyber insurance questionnaires ask what you do at the DNS layer
• You need one policy for office, VPN, and remote workers without deploying a hardware proxy

It is harder to justify as your only control if you handle regulated data, run flat networks, or have executives who insist on local admin and personal browser profiles. Filtering helps; it does not fix architecture.

Pair it with basics or skip the fancy tier

Do this either way:

• Point office DNS to the filter (firewall, DHCP, or Active Directory forwarders)—do not rely on “hope they use it”
• Block outbound DNS except to your chosen resolvers so bypass is harder
• Use MFA on email and admin accounts; most damage still starts in the inbox, not a random ad network

Optional but useful:

• Category blocks for gambling, newly registered domains, or file-sharing sites if policy supports it
• Roaming clients via lightweight agent or VPN that enforces the same resolver

Do not do this:

• Turn on aggressive blocking without a break-glass allow process (payroll sites love looking “suspicious” on day one)
• Assume DNS filtering replaces EDR or firewall egress rules
• Forget guest Wi-Fi—either filter it too or accept that visitors are on a different risk path

Bottom line

For SMBs, DNS filtering is worth it as a cheap, broad net—not as a complete security program. Deploy it at the resolver, stop easy bypass, and stack MFA, patching, and sensible network segmentation on top. If you cannot do those basics, buy the filter anyway, but fix the basics first.