Every attack asks
DNS first.
NameDefence runs your DNS firewall, authoritative DNS and DNSSEC, DHCP and IPAM, web gateway and GSLB from a single agent on your own servers. Every query is seen, evaluated and logged, and your logs never leave the organization.
- One agent: DNS · DHCP · SWG · GSLB
- DoH · DoT · DoQ
- Timestamped log archive
- 10.20.1.5isc.orgDNSKEY · 18 msDNSSEC ✓
- 10.20.9.12fresh-domain.exampleA · 41 msNew domain · warn
- 10.20.5.61login-micros0ft.exampleA · 0.1 msPhishing · RPZ
- 10.20.3.8aGVsbG8gd29ybGQ.t.exampleTXT · 0.2 msTunnel
- 10.20.7.42x7kq2v9lmzpw.exampleA · 0.2 msDGA
- 10.20.4.17portal.kurum.exampleA · 0.3 msAllowed
On-premises
Manager, Defenders and logs live on your servers. Only domain names are looked up in the cloud.
One agent
DNS, DHCP, SWG, DLP and GSLB in the same Defender binary. Linux amd64 and arm64.
Open standards
DNSSEC, RPZ, DoH/DoT/DoQ, AXFR/IXFR, TSIG, GSS-TSIG, TAXII 2.1, RFC 3161.
Always answering
The Manager runs active/passive and Defenders share load behind a virtual IP. If one server goes down, DNS keeps answering.
A single DNS query passes through six layers.
The moment a client asks for a name, Defender checks the source, intelligence, policy and behavior, validates the answer and records the event. All in milliseconds, in one process.
- 01Source
- 02Intelligence
- 03Policy
- 04Behavior
- 05Resolution
- 06Record
- 01 · Source
Who is asking?
The client IP is mapped to a user and computer name. Access lists, per-client rate limits and quarantine apply first.
ACLRate limit (IP, /24, /56)IPv6 /64 quarantineAD · Entra user - 02 · Intelligence
Is it known bad?
RPZ zones are checked by name, client IP, answer IP, NSDNAME and NSIP triggers. Feeds arrive over AXFR/IXFR, TAXII 2.1, MISP and URL sources.
RPZNSDNAME / NSIPTAXII 2.1 · MISPShared hosting kept reachable - 03 · Policy
What does the organization say?
A rule chain runs per user, group and source. AI categorization, SafeSearch, warn-and-continue and time-limited bypass codes share one engine.
CategorySafeSearchWarn · bypass codeBlock page - 04 · Behavior
Does it look suspicious?
Newly registered domains, DGA-generated names, DNS tunnels and random-subdomain attacks are caught in real time.
NRDDictionary DGADNS tunnelRandom subdomain - 05 · Resolution
Is the answer genuine?
The local resolver checks the answer's signature and the organization's own zones answer directly. Forged answers never make it into the cache.
DNSSEC validationAuthoritative zoneServe-staleDNS64 · ECS - 06 · Record
What happened, and who did it?
Every decision is logged with the user name; passive DNS, alarms, SOAR/ITSM tickets and EDR isolation are triggered from here. Archives are sealed with a trusted timestamp.
Passive DNSAlarm → SOAREDR isolationRFC 3161
The job of five separate products, on one platform.
From the resolver to authoritative DNS, from DHCP to the web gateway, every layer runs on the same policy and the same log.
Stop the bad domain before a connection exists.
The policy engine, intelligence feeds and behavior analysis work together on every query.
01 / 06
- Rule chains per user, group and source
- AI-based domain categorization (Cloud)
- RPZ: qname, client-IP, IP, NSDNAME, NSIP
- Blocking newly registered domains (NRD)
- Dictionary + Markov DGA detection
- DNS tunnel and random-subdomain attacks
- SafeSearch, warn-and-continue, bypass codes
- HTTPS block page with its own CA
Four components. Your data stays with you.
Defenders run where the traffic is; the Manager governs and records. The cloud only provides domain intelligence and updates.
- Windows, macOS, Linux
- Defender on the LAN, DoH outside
- Logs show the signed-in user
- DNS resolver and firewall
- Authoritative zones, DHCP, SWG, DLP, GSLB
- UDP/TCP 53 · DoT/DoQ 853 · DoH
- Defenders connect to the Manager over TLS
- One entry point for branch and DMZ Defenders
- Commands and logs travel encrypted
- Policy, zones and DNSSEC signing
- Logs, reports and alarms in-house
- Active/passive HA, virtual IP
- AI categorization, WHOIS, GeoIP
- Lookalike monitoring via CT
- Licensing and updates
- Connect to your Manager on the go
- DNS Firewall, SWG, DHCP and IPAM screens
One Defender, measured with real load.
Capacity of a single Defender server, measured with dnsperf. Plan your deployment with these numbers.
0k qps
Authoritative DNS, zero loss
Internet-facing name server load
0k qps
Resolver, sustained
Realistic mixed enterprise traffic
0k qps
Authoritative DNS over TCP
Ceiling with long-lived connections
0.0ms
Latency (p99)
At 100k qps, authoritative DNS
Capacity plan for one Defender (8 vCPU)
Measured on one Defender (8 vCPU, 16 GB) with dnsperf from a separate load host. For higher load, Defenders scale out behind a DNS Balance VIP.
When the auditor asks, the record is ready.
Used by organizations including ministries, NameDefence keeps the trail regulations expect: who asked for which name, when, and what answer they got.
Law 5651 archive
Daily archives are sealed with an RFC 3161 timestamp authority and can be verified later.
KVKK / GDPR
Data stays in-house. Ready report template for log retention, access and deletion.
ISO 27001
Reports mapped to controls such as A.8.15 logging, A.8.16 monitoring, A.8.23 web filtering.
BDDK
Report template for financial institutions following the banking IT systems regulation.
Identity
Single sign-on with OIDC and SAML 2.0; AD/LDAP and Entra ID group mapping.
Key security
DNSSEC keys in an HSM (PKCS#11); audit log and policy version history.
How it is used in the field
Government and ministries
The internet-facing name server runs in DNS-Only mode while internal clients use a separate Defender with the full firewall. Timestamped archives and per-user records.
- DNS-Only authoritative
- DNSSEC + HSM
- Timestamped archive
Enterprise network
Active Directory zones with secure dynamic updates, policies by AD/Entra groups. DHCP fingerprinting recognizes every device that joins.
- AD via GSS-TSIG
- Group-based policy
- SWG + DLP
Finance and critical infrastructure
Ransomware C2 lookups are blocked, the alarm opens an ITSM ticket and EDR isolates the device. Lookalike registrations show up via CT within hours.
- Alarm → ServiceNow/Jira
- CrowdStrike · MDE
- BDDK report
Speaks to the infrastructure you already run.
Ready connectors for identity, incident management, endpoint and intelligence systems; a REST API and signed webhooks for the rest.
Identity
- Active Directory / LDAP
- Microsoft Entra ID
- OIDC
- SAML 2.0
- Kerberos (GSS-TSIG)
SOAR / ITSM
- ServiceNow
- Jira
- Webhook (HMAC)
EDR
- CrowdStrike Falcon
- Microsoft Defender for Endpoint
Threat intelligence
- STIX / TAXII 2.1
- MISP
- RPZ (AXFR/IXFR)
- OpenPhish · URLhaus
Logs and monitoring
- Syslog / SIEM
- dnstap
- Prometheus metrics
- REST API
Migration
- BIND zone files
- AXFR import
- ISC DHCPD
- Windows DHCP
- MikroTik RouterOS
NameDefence is now in your pocket
Manage it without a computer
You can now reach your NameDefence panel and take action from your phone, without a computer. Connect to your server on iOS or Android and open DNS Firewall, SWG, DHCP, and IPAM from your pocket.
- Follow dashboards and alarms anywhere
- DNS Firewall, SWG, DHCP and IPAM screens
- Connects to your own Manager
Common questions
No. Manager and Defenders run on the organization's own servers and DNS logs never leave it. NameDefence Cloud is used only for domain categories, WHOIS, GeoIP, certificate transparency monitoring, licensing and updates.
See it on your own network.
Our team listens to how your DNS and DHCP are set up and installs NameDefence with you in your lab or test environment.