DNS Filtering vs. Secure Web Gateway: Which Do You Actually Need?

DNS filtering intercepts DNS queries from endpoints and resolvers, compares the queried domain against threat intelligence feeds, and returns NXDOMAIN or a sinkhole IP for known-malicious domains instead of the real resolution. This blocks: command-and-control beaconing to known malicious domains (91% of malware uses DNS for C2, making this a high-value interception point), phishing domains in known-bad domain feeds, newly registered domains used in spam campaigns, and domains associated with known malware families, cryptomining, and botnet infrastructure.

DNS filtering's coverage gaps are significant and predictable. It operates at the domain level, not the URL level — a compromised legitimate domain (like a hacked WordPress site hosting a phishing page) will not be blocked because the domain itself is not malicious. It cannot inspect the content of encrypted HTTPS connections — whether the traffic over a domain is malware delivery or legitimate file download is invisible to DNS. It cannot enforce DLP policies — it has no visibility into what data is being uploaded or downloaded. It cannot distinguish between legitimate and malicious use of CDN and cloud storage services that share domains (Dropbox.com, OneDrive.com, GitHub.com) — blocking these domains breaks legitimate productivity.

DNS-over-HTTPS (DoH) is a growing evasion vector. When browsers send DNS queries directly to DoH resolvers (Cloudflare 1.1.1.1, Google 8.8.8.8) rather than using the corporate resolver, DNS filtering is bypassed entirely. DNS filtering deployments must enforce DNS resolver use via firewall rules blocking port 853 (DoT) and HTTPS to known DoH resolver IPs, and via group policy settings that prevent browser DoH configuration.

A Secure Web Gateway sits inline on web traffic (either as a proxy or via network interception) and provides visibility and control that DNS filtering cannot reach.

TLS inspection is the SWG's most important capability: it performs man-in-the-middle decryption of HTTPS traffic, inspects the decrypted content for malware, phishing, and DLP violations, then re-encrypts and forwards compliant traffic. This is the only way to inspect what is inside HTTPS connections — 72% of enterprise web traffic is HTTPS, meaning a DNS-only deployment is blind to almost three-quarters of web activity. TLS inspection requires deploying a trusted CA certificate to endpoints for the SWG's decryption certificate to be trusted — this is a deployment requirement that DNS filtering does not have.

URL categorization at the full URL level (not just domain) enables blocking specific paths on legitimate domains: blocking dropbox.com/upload while permitting dropbox.com/download, or blocking specific URLs within a legitimate cloud storage service rather than blocking the entire domain. This granularity is impossible at the DNS layer.

Cloud application control (CASB-lite functionality) in SWG platforms distinguishes between managed and unmanaged instances of cloud apps: permitting access to the corporate Google Workspace tenant while blocking access to personal Gmail for data upload. This prevents data exfiltration via personal cloud accounts while preserving productivity.

Inline DLP inspects the content of uploads for patterns matching sensitive data — credit card numbers, Social Security numbers, proprietary document fingerprints — and blocks or logs exfiltration attempts. No DNS filtering solution provides this capability.

Four vendors dominate the DNS filtering and SWG market, each with different architecture, pricing models, and strengths.

Cisco Umbrella is the most widely deployed DNS security platform in enterprise environments, with 30-plus years of DNS data underpinning its threat intelligence. Umbrella's Predictive Intelligence uses machine learning to identify malicious domains before they appear in threat feeds — blocking newly registered domains used in attack campaigns before they become widely known. Umbrella's SWG module adds TLS inspection and URL categorization for organizations that need full SWG capability on the Umbrella platform. The Cisco Security Cloud integration provides joint deployment with Cisco Secure Endpoint, ISE, and Secure Firewall.

Cloudflare Gateway is the DNS filtering and SWG component of Cloudflare One (their SASE platform). Its primary differentiators are performance (Cloudflare operates the world's largest anycast network, making DNS resolution and proxy throughput faster than most alternatives) and price accessibility (the Teams tier is more affordable than Cisco Umbrella for mid-market organizations). Gateway's integration with Cloudflare Access (ZTNA) and Cloudflare's global network makes it the strongest option for organizations deploying Cloudflare as their primary network security vendor.

Zscaler Internet Access (ZIA) is the enterprise-grade cloud SWG and is typically the strongest choice when full SWG capability — TLS inspection, DLP, CASB, cloud app control — is required at large scale. ZIA is designed for enterprises with complex policy requirements and integrates with Zscaler Private Access (ZPA) for a complete SASE deployment. It is priced at the enterprise tier and is not typically cost-competitive for organizations under 1,000 users.

Palo Alto Prisma Access includes DNS Security (powered by Advanced Threat Prevention) as a module within its SASE platform. For organizations standardized on Palo Alto, DNS Security integrates natively with Cortex XDR and Panorama for unified policy management. Palo Alto's ML-based DNS threat detection identifies DNS tunneling (data exfiltration via DNS query encoding) more effectively than feed-based approaches.

DNS filtering deployment requires redirecting all client DNS queries through the filtering resolver. For corporate-managed endpoints, this is done via DHCP configuration (setting the DNS resolver IP to the filtering platform's resolver) combined with group policy settings to prevent manual DNS reconfiguration. For remote endpoints not on the corporate network, a lightweight agent (Cisco Umbrella Roaming Client, Cloudflare WARP) enforces DNS resolver routing regardless of network location.

DNS-over-HTTPS bypass prevention is a deployment requirement that many organizations miss. Modern browsers (Chrome, Firefox, Edge) support DoH and can be configured to use DoH resolvers directly, bypassing corporate DNS filtering entirely. Enforce resolver control by: (1) blocking outbound HTTPS to known DoH resolver IP addresses at the firewall (Cloudflare 1.1.1.1, Google 8.8.8.8/8.8.4.4, Quad9 9.9.9.9); (2) setting browser enterprise policy to disable DoH or force use of the corporate DNS-over-HTTPS endpoint; and (3) blocking DNS-over-TLS (port 853) at the firewall.

SWG TLS inspection deployment requires planning for certificate trust and inspection exclusions. Deploy your SWG's CA certificate to all managed endpoints before enabling TLS inspection — users will see certificate errors on all HTTPS sites until the CA is trusted. Establish inspection exclusions for categories where TLS inspection creates legal or operational issues: financial and banking sites (compliance concerns in some jurisdictions), healthcare portals (HIPAA considerations), and software update services (TLS inspection can break pinned certificate validation in update clients).

DNS filtering alone is appropriate for: organizations with limited budget and headcount that need a meaningful first layer of web-based threat protection; networks where TLS inspection infrastructure is not feasible (OT/ICS environments, IoT networks); and as a supplementary control layered beneath a full SWG (DNS filtering stops threats before they reach the SWG, reducing TLS inspection load and SWG processing costs).

SWG without DNS filtering is uncommon because DNS filtering is lower cost, lower latency, and provides C2 beaconing detection that SWG TLS inspection does not efficiently deliver. Most SWG deployments layer DNS filtering on top of SWG functionality.

Both DNS filtering and SWG are appropriate for: organizations with DLP requirements (SWG is required for content inspection); organizations with cloud application governance requirements (CASB functionality requires SWG); organizations where insider threat or data exfiltration is a primary concern (DNS filtering cannot detect exfiltration over HTTPS); and organizations with compliance requirements for demonstrating web content inspection capability.

For mid-market organizations choosing a first web security deployment: DNS filtering via Cloudflare Gateway or Cisco Umbrella provides the fastest time-to-value and lowest deployment complexity. Add SWG capability when DLP, cloud app control, or compliance requirements create a specific need for content-level inspection.