DNS Security
Secure the protocol attackers hide in.
Catoβs DNS Security inspects all DNS traffic, preventing malicious DNS activity hiding within the protocolβs traffic, and blocking DNS requests to malicious destinations before a connection is made.
Todayβs Challenges
DNS is where attacks hide.
DNS is a security blind spot
DNS traffic has to be allowed through, so attackers hide malicious activity inside the protocol where most controls never look.
DNS blind spot
Phishing
DNS tunneling
Crypto mining
Our approach
Inspect every request.
Block before connection.
DNS is one of the most abused paths for malware and exfiltration, and one of the least watched. Cato DNS Security inspects every query against real-time threat intelligence and AI analysis, blocking malicious and risky domains before a connection is ever made.
Inspect all DNS
Inspect every DNS request in real time β including malicious activity hiding inside permitted DNS traffic.
Detect with AI/ML
Models trained on Catoβs global data lake identify phishing, impersonation, tunneling, and crypto-mining patterns.
Block before connection
Block DNS requests to malicious destinations before a connection is ever made β with near-zero false positives.
Solution Brief
Stop Threats Everywhere with Converged Zero Trust Security
How it works
DNS Security Capabilities
Real-time AI/ML inspection
AI-based DNS inspection for inline phishing protection
AI and ML trained on Catoβs global data lake identify domain squatting and website impersonation in-line.
Analyze webpage components, domain age, and popularity
Spot patterns tied to known phishing toolkits
Prevent credential harvesting and malware delivery
Anomaly-based, threat-agnostic
Stop data loss over DNS tunneling
Cato analyzes DNS request properties to identify anomalies and indicators of DNS tunneling attacks.
Inspect packet size, record type, and subdomain ratios
AI/ML continuously trained to spot tunneling
Protection independent of threat actor or domain
Customer Stories
Customers love Cato
β
I canβt fault Cato when you connect a site. The level of automatic blocking for bad traffic is something you donβt see with other setups, especially with DNS.
IT Operations Manager
Global Mining Equipment Manufacturer
Senior Security Engineer
Midsize Specialist Insurance Provider
Director, Information Technology
Specialized Nonprofit Organization
Get a live demo
Secure every interaction across the enterprise, cloud, and AI with the only purpose-built SASE platform.
What to expect
15β30 minute session with a SASE product expert
Discuss your use cases and how we can help
Live product demonstration where applicable
Get Started
See Cato in Action
FAQS
Answers to common questions
What risks does Cato DNS Security protect against?2 questions
What is Cato DNS Security and what does it protect against?
Cato DNS Security inspects all DNS traffic in real time to prevent malicious activity hiding within the protocol. It blocks DNS requests to malicious destinations before a connection is ever made, and protects against phishing, domain squatting, website impersonation, DNS tunneling, and crypto-mining activity.
What types of enterprises benefit most from DNS security?
Any organization that relies on DNS traffic, which is effectively every enterprise, faces exposure to phishing, tunneling, and malware delivery through the protocol. DNS security is particularly valuable for organizations that need to close blind spots left by perimeter tools that do not inspect DNS traffic inline.
How does Cato detect and block DNS-based threats before connection?5 questions
How does DNS-layer blocking differ from traditional security approaches?
Blocking at the DNS layer stops communication with malicious servers before a TCP or UDP connection is established. This means threats such as malware delivery and command-and-control activity are cut off earlier in the attack chain, before any payload reaches endpoints, rather than being detected after a connection has already been made.
How does Cato detect phishing and domain impersonation?
AI and ML models trained on Cato’s global data lake analyze webpage components, domain age, domain popularity, and patterns tied to known phishing toolkits. This allows the system to identify domain squatting and website impersonation inline, catching threats before reputation-based tools have time to catch up.
How does Cato identify DNS tunneling without knowing the specific attacker?
Cato analyzes DNS request properties including packet size, record type, and subdomain ratios to detect anomalies associated with tunneling. Because detection is anomaly-based and threat-agnostic, it does not require prior knowledge of the specific threat actor or domain involved.
Does Cato DNS Security block newly registered domains?
Yes. Cato DNS protection includes blocking of domains registered within the last 14 days, which reduces exposure to newly created malicious infrastructure that has not yet been flagged by threat intelligence feeds.
What does “near-zero false positives” mean in practice for DNS blocking?
Cato’s approach to DNS inspection is designed to block malicious destinations with near-zero false positives, meaning legitimate business traffic is not disrupted. The AI/ML models are continuously trained on Cato’s global data lake to maintain accuracy as threat patterns evolve.
How does Cato DNS Security fit into the broader SASE platform?2 questions
How does Cato DNS Security compare to standalone DNS security tools?
Unlike standalone DNS security products, Cato DNS Security is part of the converged Cato SASE Cloud platform. This means DNS inspection is correlated with other security engines across the same platform rather than operating in isolation, giving security teams unified visibility and policy management without navigating between separate tools.
Is Cato DNS Security recognized by independent analysts?
Yes. Cato Networks has been recognized as a Leader in the 2025 Gartner Magic Quadrant for SASE Platforms, a Leader and Outperformer in the GigaOm 2025 SASE Radar, and a Growth and Innovation Leader in SASE by Frost and Sullivan.
