Introduction to Cloud DNS

Cloud DNS turns a Sign In Enterprise network from plain DNS forwarding into a managed, filtering resolver that Netgraph runs for that network. Each lookup is checked against the policy you set before it is answered: blocked domains do not resolve, allowlisted domains always do, and rulesets decide which part of the network a policy covers and when.

What it is

• A managed filtering resolver per network, delivered as an add-on to Sign In Enterprise through the Service Gateway.
• Blocklists you subscribe to by URL (fetched and kept refreshed for you) or build yourself.
• Allowlists that always override blocklists.
• Custom DNS records (host to IP) for internal names.
• Rulesets that combine lists, an audience (the whole network or selected sites), and an optional weekly schedule.

What it is not

• Not an intrusion-prevention system, anti-malware engine, or deep content inspector.
• Not a public DNS service: it filters only for networks delivered through Sign In Enterprise and the Service Gateway.
• Not a URL or content filter: it matches domains, not paths or page content.

How a lookup is decided

1. A client on the network makes a DNS lookup.
2. Cloud DNS checks it against the rulesets that apply to that client, at that moment.
3. If a matching ruleset blocks the domain, the lookup is dropped. There is no block page and no prompt: the name simply does not resolve. Allowlisted domains always resolve, and everything else is resolved normally.

What’s next

• Service description covers architecture, rulesets, requirements, and responsibilities.
• License & Terms covers scope, requirements, and SLA alignment.