Threat blocking · at the DNS level

DNS Malware and Phishing Blocking: Stop Threats Before They Load

Almost every online attack starts the same way: your device asks the internet where a domain lives, then connects to the address it gets back. Malware, phishing and ransomware all lean on that first step. If the dangerous name simply never resolves, the connection never begins — the infected file never downloads, the fake login page never opens, the ransomware never phones home. That is exactly what AEU DNS does. It is a filtering forwarder: a privacy-first DNS service that checks every name your device looks up against lists of known-malicious domains — malware, phishing, ransomware and command-and-control (C2) servers, the addresses an infected device calls to receive instructions — and refuses to resolve the ones on those lists.

What DNS-level blocking stops before it loads

Malware domains. Sites that host or spread malicious software are refused at the naming step, so the download never starts and the infection never gets a chance to install.

Phishing sites. Fake login pages built to steal passwords are never reached. Because the name does not resolve, the convincing copy of your bank or mail login never renders in your browser.

Ransomware. Domains used to deliver or control ransomware are blocked before the payload can be fetched, so the encryption attack is cut off at its first network request.

Command-and-control (C2). If a device is already infected, the malware cannot reach its control server to receive instructions or exfiltrate data — the C2 name is refused, and the botnet connection is severed.

DNS filtering vs antivirus — two different, complementary layers

Antivirus removes threats after they arrive; DNS blocking stops them from ever arriving. AEU DNS works alongside it.

Antivirus = reacts to what already reached the device. It scans files and processes after they land, detecting and removing malware that is already running or stored. It needs an agent installed on every device and a signature it recognises.

DNS filtering = stops the connection before anything is delivered. It blocks the domain before any file is fetched, any page loads or any C2 call succeeds — at the network level, before the threat touches the device.

Together = defence in depth. AEU DNS removes a large share of the attack surface before it ever reaches your device, while your antivirus keeps catching whatever still slips through — one layer blocks at the door, the other sweeps the room.

Every device, no per-device installs

Because AEU DNS blocks at the naming step, the protection follows your DNS configuration — not an app you have to install. Point any device at your AEU DNS profile and phones, tablets, laptops and even smart-home gadgets that cannot run an antivirus are protected the same way, while the filtering itself stays no-log by design.

Block malware and phishing before they load

Create a free account, get your DNS profile and personal mTLS certificate, and copy-paste one configuration onto any device.

Create your account

Keep exploring

Start from the AEU DNS home page, or read how encrypted DNS works for a plain-language walk-through of how encrypted DNS protects you. Our GDPR-compliant DNS explainer covers the European privacy side.

Frequently asked questions

How does DNS-level malware blocking work?

When your device looks up a domain, AEU DNS — a filtering forwarder — checks that name against lists of known malware, phishing, ransomware and command-and-control domains before forwarding the query upstream. If the name is on a list, AEU DNS refuses to resolve it, so the connection never starts and no traffic ever reaches the malicious server.

Does AEU DNS replace my antivirus?

No — it complements it. DNS blocking stops a threat from ever reaching your device, while antivirus catches and removes whatever still arrives another way. Together they give you defence in depth; neither replaces the other.

What is a filtering forwarder, exactly?

A resolver answers DNS queries itself. A filtering forwarder sits in front of an upstream resolver, inspects every query and filters out the names it has classified as dangerous, then forwards only the safe ones onward. AEU DNS is a filtering forwarder, not a resolver.

Does it work on devices where I cannot install software?

Yes. Because the blocking happens at the DNS naming step, any device that can be pointed at your AEU DNS profile is protected — including smart TVs, IoT gadgets and other hardware that cannot run an antivirus agent. There is nothing to install on each device.

Will blocking break legitimate sites?

AEU DNS filters against curated threat lists and forwards every non-malicious query normally, so legitimate sites resolve as usual. Only names classified as malware, phishing, ransomware or command-and-control are refused.