Introduction to Cloud DNS

Cloud DNS turns a Sign In Enterprise network from plain DNS forwarding into a managed, filtering resolver that Netgraph runs for that network. Each lookup is checked against the policy you set before it is answered: blocked domains do not resolve, allowlisted domains always do, and a policy decides which part of the network it covers and when.

What it is

• A managed filtering resolver per network, delivered as an add-on to Sign In Enterprise through the Service Gateway.
• Categories: curated blocklists that Netgraph maintains and keeps current, grouped as Security, Content, and Ads and tracking. You pick the ones your network needs; there is nothing to source or refresh.
• Your own blocklists, subscribed to by URL and kept refreshed for you, or maintained by hand in the console.
• Allowlists for the exact names that must resolve even when a list contains them.
• Internal DNS records (host to IP) for names that never reach public DNS.
• Policies that combine the lists with an audience (the whole network or selected sites) and an optional weekly schedule.
• A domain lookup that checks one name against every policy and names the list that blocks it, and usage statistics per network: queries answered and blocked, from today back to twelve months.

Getting protection in place

A network that has just been switched to Cloud DNS can start from the recommended categories: Malware, Phishing & C2, and Scam & Fake Shops. That is one policy and no research, and it is the sensible baseline for almost any network. From there you add the categories that match what the network is for, such as Adult and Gambling on a school network, and keep lists of your own for anything specific to your organization.

What it is not

• Not an intrusion-prevention system, anti-malware engine, or deep content inspector.
• Not a public DNS service: it filters only for networks delivered through Sign In Enterprise and the Service Gateway.
• Not a URL or content filter: it matches domains, not paths or page content.

How a lookup is decided

1. A client on the network makes a DNS lookup.
2. Cloud DNS checks it against the policies that apply to that client, at that moment.
3. If a matching policy blocks the domain, or a parent domain of it, the lookup is dropped. There is no block page and no prompt: the name simply does not resolve. A name that is on an allowlist resolves, and everything else is resolved normally.

What’s next

• Service description covers architecture, categories, policies, requirements, and responsibilities.
• License & Terms covers scope, requirements, and SLA alignment.