Content Filtering FAQ

This guide covers common questions about DNS-based content filtering, including how it works, configuration options, and best practices for implementing content controls.

Content Filtering Basics

What is DNS-based content filtering?

DNS-based content filtering blocks access to websites and online content by filtering Domain Name System (DNS) queries. Instead of inspecting web content, it prevents devices from connecting to restricted domains at the DNS level.

How does DNS filtering work?

Query Interception: DNS queries are sent to your configured DNS server
Policy Check: The server checks the requested domain against filtering rules
Response Decision:
- Allowed: Returns the actual IP address
- Blocked: Returns a blocked response (NXDOMAIN or custom IP)
Client Handling: Browser/app receives the response and either connects or shows an error

What are the advantages of DNS filtering?

Network-Level Protection: Works across all devices and applications
Performance: Minimal latency impact compared to content inspection
Privacy: No content inspection means no data payload analysis
Simplicity: Easy to deploy and manage
Compatibility: Works with all internet-connected devices

Xerobi Content Filtering Options

Filtering Levels

Xerobi provides three levels of content filtering through different DNS ports:

Port 53 - No Filtering

Purpose: Standard DNS resolution
Content: All domains allowed
Use Case: Maximum compatibility, no restrictions

Port 54 - Malware Protection Only

Purpose: Security-focused filtering
Blocks: Malware, phishing, botnets, exploit sites
Allows: Adult content, gambling, social media
Use Case: Essential security without content restrictions

Port 55 - Comprehensive Protection

Purpose: Full content and security filtering
Blocks: Malware + adult content + gambling + explicit material
Use Case: Strict environments (schools, businesses, families)

Content Categories

Security Categories (All Ports)

Malware Domains: Virus distribution, trojan hosting
Phishing Sites: Fake login pages, credential theft
Botnet C&C: Command-and-control servers
Exploit Kits: Browser and system vulnerability sites
Malicious Downloads: Infected file hosting

Content Categories (Port 55 Only)

Adult Content: Pornography, adult entertainment
Gambling: Online casinos, betting platforms
Dating Services: Adult-oriented dating sites
Explicit Material: Sites hosting adult media

Implementation

Network-Level Configuration

Router Configuration:

# DHCP DNS server assignment
# Set all devices to use filtered DNS
dhcp-option=6,165.101.132.104,165.101.132.105

Firewall Rules:

# Allow only filtered DNS queries
iptables -A INPUT -p udp --dport 53 -s [your-network] -d 165.101.132.104 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -s [your-network] -d 165.101.132.105 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -d [other-dns] -j DROP

Device-Level Configuration

Windows Group Policy:

Open Group Policy Editor (gpedit.msc)
Navigate to: Computer Configuration → Administrative Templates → Network → DNS Client
Set “DNS Servers” to 165.101.132.104,165.101.132.105

macOS Configuration Profile:

<dict>
    <key>DNSSettings</key>
    <dict>
        <key>ServerAddresses</key>
        <array>
            <string>165.101.132.104</string>
            <string>165.101.132.105</string>
        </array>
    </dict>
</dict>

Application-Specific Setup

Chrome Extension:

// Force DNS for specific domains
chrome.privacy.network.networkPredictionOptions = 'disabled';
// Use system DNS settings

Docker Containers:

version: '3.8'
services:
  app:
    dns:
      - 165.101.132.104
      - 165.101.132.105
    dns_search:
      - yourdomain.com

Advanced Configuration

Conditional Filtering

Time-Based Filtering:

# Allow adult content only during certain hours
# Requires custom DNS server configuration
# Contact support for advanced filtering rules

User-Based Filtering:

# Different filtering levels per user/group
# Implement via VLANs or separate DNS servers

Custom Allow/Block Lists

Override Domains:

# Allow specific blocked domains
# Contact [email protected] for whitelist requests

Additional Blocking:

# Block additional categories
# Custom filtering available for enterprise clients

Performance Considerations

Speed Impact

DNS filtering adds minimal latency:

Standard Queries: < 5ms additional latency
Filtered Queries: < 10ms additional latency
Cache Hit: No performance impact

Bandwidth Usage

Query Overhead: ~50 bytes per filtered query
Update Traffic: Blocklist updates (~1MB/day)
Monitoring: Optional logging traffic

Caching Strategies

DNS Cache Optimization:

# Increase cache size for better performance
# Windows
dnscmd /config /cachetimeout 3600

# Linux
# /etc/systemd/resolved.conf
Cache=yes
CacheFromLocalhost=no

Troubleshooting

Common Issues

Sites not loading:

Check if domain is blocked by your filtering level
Verify DNS server configuration
Clear DNS cache: ipconfig /flushdns

Inconsistent filtering:

Some devices may bypass DNS settings
Check for VPN or proxy usage
Verify firewall rules

Slow performance:

Test with different DNS servers
Check network latency
Verify blocklist update status

Diagnostic Tools

Test filtering:

# Check if domain is blocked
nslookup blocked-domain.com 165.101.132.104

# Should return NXDOMAIN for blocked sites

Monitor DNS traffic:

# Linux - tcpdump
tcpdump -i eth0 port 53

# Windows - PowerShell
Get-NetEventSession | Where-Object { $_.Name -like "*DNS*" }

Check DNS resolution:

# Test all filtering levels
dig @165.101.132.104 example.com  # No filtering
dig @165.101.132.104:54 example.com  # Malware only
dig @165.101.132.104:55 example.com  # Full filtering

Best Practices

For Home Networks

Start with Malware Protection: Use port 54 for essential security
Gradual Implementation: Test filtering before full deployment
Device-Specific Rules: Use different filtering for different devices
Regular Monitoring: Check blocked queries and adjust rules
User Education: Explain filtering to family members

For Businesses

Policy-Based Filtering: Different levels for different departments
Compliance Requirements: Meet regulatory content filtering needs
Employee Training: Educate staff about acceptable use
Incident Response: Monitor for security threats
Regular Audits: Review filtering effectiveness

For Schools/Educational

Age-Appropriate Filtering: Balance security with educational needs
Bypass Mechanisms: Controlled access for staff/research
Content Categories: Customize based on curriculum needs
Reporting Tools: Monitor filtering activity
Parental Communication: Keep parents informed

Limitations and Considerations

Technical Limitations

DNS-Only Filtering:

Cannot filter content within allowed domains
HTTPS sites may bypass some restrictions
IP-based access circumvents filtering

Bypass Methods:

VPN services
Proxy servers
Direct IP access
Alternative DNS servers

Privacy Considerations

Query Logging:

DNS queries may be logged for security analysis
No content inspection maintains privacy
Data retention policies apply

Data Handling:

Minimal personal data collection
Aggregated analytics only
GDPR/CCPA compliance

Integration with Other Security

Multi-Layer Security

Complementary Technologies:

Web Filtering: Content inspection at proxy level
Endpoint Protection: Antivirus and malware prevention
Network Security: Firewall and intrusion prevention
User Training: Security awareness programs

Recommended Stack:

DNS Filtering (Xerobi) - Network-level blocking
Web Proxy - Content inspection
Endpoint Security - Device protection
User Education - Behavioral security

Enterprise Integration

Directory Services:

# Active Directory integration
# Group Policy for DNS configuration
# User-based filtering policies

SIEM Integration:

# Log forwarding to security systems
# Real-time threat detection
# Compliance reporting

Support and Resources

Getting Help

Configuration Support:

Email: [email protected]
Documentation: Check our DNS service guides
Community: Developer forums and discussions

Custom Requirements:

Enterprise filtering needs
Custom allow/block lists
Integration assistance

Useful Links

Testing Tools:

DNS leak test sites
Content filtering test domains
Performance monitoring tools

Industry Resources:

DNS filtering best practices
Content classification standards
Security compliance guides

Frequently Asked Scenarios

”How do I allow a blocked site?”

Verify the site is actually blocked
Check your filtering level (port 53/54/55)
Contact support for whitelist requests
Consider if blocking is necessary

”Why is filtering not working on my mobile?”

Check DNS settings in Wi-Fi configuration
Verify no VPN is active
Test with different browsers
Check cellular data vs Wi-Fi

”Can I see what sites are being blocked?”

Monitor DNS query logs
Use diagnostic tools to test domains
Check our status page for service health
Contact support for detailed reports

DNS Service

Complete DNS service documentation

DNS Security

DNS security best practices

Network Security

Network security guidelines

Content Classification

Content classification standards

​Content Filtering FAQ

​Content Filtering Basics

​What is DNS-based content filtering?

​How does DNS filtering work?

​What are the advantages of DNS filtering?

​Xerobi Content Filtering Options

​Filtering Levels

​Port 53 - No Filtering

​Port 54 - Malware Protection Only

​Port 55 - Comprehensive Protection

​Content Categories

​Security Categories (All Ports)

​Content Categories (Port 55 Only)

​Implementation

​Network-Level Configuration

​Device-Level Configuration

​Application-Specific Setup

​Advanced Configuration

​Conditional Filtering

​Custom Allow/Block Lists

​Performance Considerations

​Speed Impact

​Bandwidth Usage

​Caching Strategies

​Troubleshooting

​Common Issues

​Diagnostic Tools

​Best Practices

​For Home Networks

​For Businesses

​For Schools/Educational

​Limitations and Considerations

​Technical Limitations

​Privacy Considerations

​Integration with Other Security

​Multi-Layer Security

​Enterprise Integration

​Support and Resources

​Getting Help

​Useful Links

​Frequently Asked Scenarios

​”How do I allow a blocked site?”

​”Why is filtering not working on my mobile?”

​”Can I see what sites are being blocked?”