I changed one digit in my DNS, and it started blocking malware for free

For years, I’ve grappled with keeping the devices in my home safe from malware. I’m fairly savvy when it comes to security, and I like to think I’ve instilled some of that caution in my kids, too.

But I’ve taken an additional step on our devices to add some extra protection for security and privacy, and all it takes is changing one digit in your custom DNS setup.

DNS-based filtering makes blocking malware simple

It’s not just scanning; it’s refusing it to begin with

DNS is the part of the internet that maps a domain name to an IP address that your device can connect to. Every time you visit a site, your device asks a DNS resolver, “Where does this live?” and receives an answer.

Most folks are using the DNS that comes with their home network. That’s not inherently a problem, although there are numerous reasons why switching is worthwhile.

One of the biggest is that while your ISP DNS will block some dangerous content, third-party DNS providers typically take it to the next level with advanced filtering and blocking that keep you and your devices safer online.

A filtering resolver keeps a running list of domains known to host malware, phishing pages, or botnet infrastructure. When you ask for one of those, it doesn’t hand you the real address. It either refuses to answer or redirects you to a block page. Your browser never connects to the malicious server at all.

So, instead of potentially landing on a malware site or similar, you find the webpage or service blocked, saving yourself a whole bunch of time and effort.

One changed DNS digit is all it takes to be safe

Major DNS providers like Cloudflare and Quad9 specifically build out filtering DNS resolvers to give regular folks easy options for better security.

For example, with Cloudflare:

1.1.1.1 is its basic resolver
1.1.1.2 adds malware blocking
1.1.1.3 adds malware blocking with adult content filtering

It’s a similar story with Quad9, though it’s filtering addresses actually run in reverse:

9.9.9.9 filters malicious domains by default
9.9.9.10 is the fully unfiltered version

You can find similar single-digit DNS changes with other providers, too, such as AdGuard, CleanBrowsing, OpenDNS, and many more.

These are tiny changes that add up to a big security and privacy boost around your home, but most folks never stumble upon them because they don’t always appear on “best DNS servers” lists over the mainstream, unfiltered options.

Change the DNS on your router if possible

Get network-wide filtering in minutes

The easiest way to make sure a filtering DNS is taking care of your whole home is to install it on your router. This way, instead of having to plug the same numbers into every device on your network individually, they all take their DNS cue from the router.

Assuming your router isn’t locked down by your ISP to prevent access, you should be able to log into the router admin panel, find a setting such as WAN or DNS settings, and then set one of the custom DNS providers.

For example, if you wanted to use Cloudflare’s malware-protection DNS, you’d enter 1.1.1.2 as the primary address and 1.0.0.2 as the secondary address.

Then, once you save (and potentially reboot) your router, all of the devices on your network (connected to the router) will begin using the new DNS settings. However, if you can’t access your router’s DNS settings, configuring each endpoint is your best bet.

Run a quick test to see if the DNS filtering is working on Cloudflare or Quad9

Using those same Cloudflare settings, you can quickly test if Cloudflare is doing its job.

command prompt check dns settings cloudflare.

Press CTRL + X and select Terminal.
Input nslookup malware.testcategory.com

You should see the DNS address, and the malware lookup heading to a sinkhole labled 0.0.0.0 if everything is working as it should.

There is a similar way to test if you opted for Quad9’s secure DNS option instead:

command prompt check dns settings quad9.

Press CTRL + X and select Terminal.
Input nslookup blocked.test.on.quad9.net

If everything is working as it should, you’ll see the message “dns9.quad9.net can’t find blocked.test.on.quad9.net: Non-existent domain.”

What DNS filtering can’t protect you against

DNS filtering is really useful, especially when it comes to protecting all of the devices in your home. However, it’s not without limitations.

For example, DNS filtering won’t stop you from opening a malicious attachment that you’ve already downloaded, and may not stop you from downloading one to begin with, depending on the type of malware or scam you engage with. Similarly, social engineering attacks that have you hand over a login and password combination are unlikely to be stopped by DNS filtering; at the very least, it’s more difficult to pick them up due to the dynamic nature of these attacks.

It also won’t confirm itself for you. What this means is that a page failing to load isn’t automatically proof that a site is hosting malware or similar. Generic browser errors will still appear, so testing specific domains is the best overall way to check for malicious domains.

But even with this, it doesn’t undo the reasons for making the change. A few seconds of network configuration can significantly boost your security, and all it takes is a single DNS digit.