· cyber security · 5 min read
DNS Filtering in Co-Managed IT: Who Owns the Block List
DNS filtering stops known-bad sites before a connection starts. In co-managed IT the harder part is deciding who approves allow-list requests, who reads the logs, and who closes the bypasses.
Picture a contact center at 7:55 a.m. Sixty agents are logging in for the shift, and the customer portal for your biggest client shows a block page where the login should be. The queue starts filling while the shift lead hunts for someone who can fix it.
That is what DNS filtering costs when nobody has decided who owns the block list. This post covers the operating side in a co-managed IT setup: who approves changes, what to watch, and where the gaps open.
DNS filtering in plain terms
DNS, the Domain Name System, is the lookup that turns a web address into the number a computer connects to. A DNS filter sits in that step. It checks each lookup against lists of known-bad and unwanted domains and refuses the matches, so the connection never starts.
That covers phishing sites, hosts that serve malware, and any category your organization chooses to block. It will miss a malicious domain nobody has reported yet, and it will miss a bad link on an otherwise legitimate site. Treat it as one inexpensive layer among several.
Laptops leave the building
A filter that lives on the office firewall protects the office. The laptop a consultant takes to a client site, or the one an agent uses from a home office, goes around it.
A roaming agent closes that gap. It is a small program on the laptop that sends DNS lookups to the filtering service from any network, home Wi-Fi and hotel Wi-Fi included. Your MSP (managed service provider) can push it out through remote monitoring tools. Your in-house IT person knows which laptops exist and who carries them. Without that list, the agent covers only the devices someone remembered.
Category policies and the false-positive problem
Most filters block by category: gambling, adult content, newly registered domains, anonymizers, and more. Start with a baseline that blocks the clearly bad categories and the malicious-domain lists, then tighten from there.
Every filter also blocks things it should allow. A small vendor’s portal, a client’s file-sharing site, and a payer or supplier login page often land in “uncategorized” or “file sharing.” Expect it in the first month. How fast the fix arrives decides whether staff trust the filter or start asking you to turn it off.
Who owns the block list in co-managed IT
Co-managed IT works when every piece has a named owner. A split that tends to hold up:
- The MSP owns the filtering platform, the baseline policy, and the malicious-domain lists.
- Your internal IT team approves allow requests for business sites, because they know which vendor a department really uses.
- Anything blocked as malware or phishing goes to the MSP’s security staff for review before anyone allows it.
- Every allow entry records who asked, why, and the date.
Agree on a response time for allow requests and write it down. “Within the hour during business hours” is a fine answer. That one sentence prevents most of the 8 a.m. arguments.
Bypasses worth closing
Browsers now ship with DNS over HTTPS (DoH), which sends lookups encrypted straight to a provider and skips your filter. A managed browser policy can switch that off or point it at your filter, and the firewall can block known DoH providers.
The personal hotspot is the other one. A staff member who hits a block page and switches to a phone hotspot has left your network. On a managed laptop the roaming agent still applies the policy there. Personal phones sit outside the filter, so that part belongs in your acceptable use policy.
Logs as an early warning
Block logs show more than what got stopped. One workstation hitting blocked domains at 3 a.m. deserves a look. So does a machine that suddenly queries long strings of random-looking names, a pattern some malware produces while it searches for its controller.
Decide who reads the logs and how often. One workable arrangement: the MSP watches the alerts and opens a ticket for your IT manager when a specific device needs hands-on attention. Your IT manager decides whether the device gets pulled from the network. Once a month, both of you look at the top blocked categories and the list of allow changes.
Those logs also give cyber insurance applications and customer security questionnaires something concrete to point to.
Questions to ask your MSP
- Who can add an allow entry, and how quickly?
- Is the roaming agent on every laptop, and how do we confirm it?
- Is browser DoH controlled?
- Where do the logs go, and who reads them?
- Who gets the alert when a device keeps hitting blocked domains after hours?
We run DNS filtering for co-managed customers, including laptops that are off the office network, and we collect the logs so someone is watching around the clock. Your IT manager keeps the final say on allow requests. Our cybersecurity services cover the filtering and the monitoring, and the co-managed model keeps the person who knows your business in the loop.
Call us at 405-253-5101 or schedule a discovery call to get on the calendar.