Protective DNS for UK small businesses: what's actually available

What protective DNS actually is

Protective DNS (sometimes written PDNS) is a recursive DNS resolver that checks every domain lookup against threat-intelligence lists before answering, blocking the lookup outright if the domain is known-malicious — malware distribution, phishing, or command-and-control infrastructure malware already on a device would otherwise use to “call home.” Because it works at the DNS layer, it protects every device that’s configured to use it, without needing software installed on each one, and it can catch an already-compromised device trying to reach out, not just stop an initial infection. It’s a detection and blocking layer, not a replacement for a firewall, antivirus, or patching — it only ever sees and acts on domain names sent to the resolver you configure, nothing else.

What the NCSC actually says about who can use PDNS

The UK’s National Cyber Security Centre (NCSC) has run its own Protective DNS service since 2017 as part of its Active Cyber Defence programme, and per NCSC’s own PDNS information page, it has resolved over 2.5 trillion queries and prevented access to over 1.5 million malicious domains at the time of its most recent published figures. That scale is real, but the eligibility is specific: NCSC’s PDNS was built for, and is mandated for use by, UK public sector organisations — central government departments, and more broadly local government, the NHS, and emergency services.

Since a phased rollout that began 26 October 2023, NCSC extended a free “PDNS for Schools” offering too, with a three-year delivery contract awarded to Cloudflare Inc. (working with Accenture) announced in April 2024, per NCSC’s own announcement. Per NCSC’s own blog post introducing the service, PDNS for Schools can be used by local authorities or eligible public sector networks in Scotland, Wales and Northern Ireland that provide DNS to their schools; local authorities in England that provide DNS to their maintained schools; school internet service providers; and multi-academy trusts, academies or independent schools that don’t receive DNS from any of those providers and can implement the service themselves.

None of those eligible categories is “a UK small business” in the ordinary sense — a shop, a trades business, a professional practice, a small manufacturer. NCSC’s own guidance page, titled “Protective DNS for the private sector,” says exactly that directly: it is aimed at private sector organisations that do not qualify to use NCSC’s PDNS, and it states clearly that if an organisation does qualify for the government service, a commercially procured protective DNS service should not be treated as a substitute for it. In other words, NCSC isn’t silent on private-sector protective DNS — it has a dedicated page for it, and that page’s message is “go and procure a commercial service,” not “here’s how to apply.”

A note on sourcing: automated fetches of NCSC’s own pages for this guide returned an HTTP 403 (blocked) at verification time (2026-10-26). The facts above are drawn from NCSC’s own publicly indexed page titles and content (via search engine indexing of ncsc.gov.uk itself), with a direct link to each specific NCSC page so it can be checked by visiting ncsc.gov.uk directly — the same approach AdminKit’s best free DNS and email deliverability checkers roundup uses for a competitor’s pages blocked the same way.

What NCSC does recommend to private-sector organisations

NCSC’s private-sector PDNS guidance doesn’t leave it at “go elsewhere” — it sets out criteria for picking a commercial protective DNS provider: the provider should be trusted, with demonstrable knowledge and experience in DNS and cyber security; able to show it understands and actively blocks the kinds of threats PDNS is meant to catch; and able to give assurances that its deny lists and detection capability are kept current against new threat intelligence, not left static. Those criteria are a reasonable checklist to apply to any provider below, not just a formality.

NCSC’s separate advice for small and medium-sized organisations also points toward tools with no DNS angle but worth knowing about alongside protective DNS: the free Cyber Action Toolkit and Check Your Cyber Security tool for a general self-assessment, Exercise in a Box for testing incident response, and Cyber Essentials, NCSC’s government-backed certification built around five baseline technical controls, as the minimum standard NCSC recommends for organisations of any size.

Options a UK small business can actually buy or use

• Quad9 — free, no account or sign-up, run by the non-profit Quad9 Foundation (backed by the Global Cyber Alliance, IBM and others per its own site), blocking lookups of malware, phishing, spyware and botnet domains from an updated threat list, with a stated no-logging privacy policy. There’s no business tier or per-device dashboard — it’s the same free public resolver for a household or a business, which makes it a reasonable no-cost baseline but not a managed solution with reporting.
• NextDNS — per its own pricing page, the free tier covers 300,000 queries/month with unlimited devices and configurations and every feature available, dropping only to unfiltered resolution (not an outage) once the monthly quota is used. Its paid Pro plan (€1.99/month or €19.90/year) removes the query cap; its Business plan is listed at €19.90/month or €199/year per 50 employees and adds email support, which is sized specifically for a small-to-mid business rather than a single household.
• Cloudflare Gateway (part of Cloudflare Zero Trust) — Cloudflare publishes a free plan for Zero Trust, including Gateway’s DNS-policy filtering, aimed at small teams, with per-seat pricing applying once you grow past it; check Cloudflare’s own Zero Trust plans page for the current free-tier seat limit and feature set, since Cloudflare’s pricing pages are updated independently of this guide.
• Control D — per AdminKit’s own comparison with NextDNS and Control D, Control D states a 99.98% malware block rate on its own homepage and offers native filtering apps across major operating systems; its free trial requires creating an account, unlike Quad9’s no-signup approach.
• Cisco Umbrella — a DNS-security product built for organisations of any size up to large enterprise, per Cisco’s own product page; it offers a 14-day free trial rather than a permanent free tier, which makes it a heavier commitment to evaluate than the free options above.

Pick based on what you actually need: Quad9 if you want a free blocking resolver with nothing to manage; NextDNS or Cloudflare Gateway if you want per-device policy, reporting, or a plan explicitly sized for a small team; Control D or Cisco Umbrella if you want a vendor-backed product with native apps and support, and are willing to create an account or run a trial to get there. Verify current pricing and limits on each provider’s own page before deciding, since all of them can and do change independently of when this guide was last updated.

How AdminKit’s Protective DNS fits

AdminKit’s own Protective DNS product is planned, not live — it is early access / in development, aimed at households, shops and small offices, and small industrial sites that want malicious-domain blocking and per-device anomaly detection without buying new hardware, with a Home Assistant add-on and an OpenWrt package also planned. It does not change the picture above: a UK small business wanting protective DNS filtering today still needs one of the live options listed, since AdminKit’s resolver isn’t live yet. What is live today is diagnostic — AdminKit’s free DNS resolver test (coming with the API, same as AdminKit’s own leak-detection work covered in best free DNS leak test tools) and DNS lookup tool, both useful for understanding your current DNS setup while you evaluate a filtering provider.

The bottom line for a UK small business

If you run a typical UK small business — not central or local government, the NHS, or a school covered by PDNS for Schools — NCSC’s own free Protective DNS service isn’t available to you, and NCSC’s own guidance says so directly rather than leaving it ambiguous. The practical path is a commercial protective DNS provider, chosen against NCSC’s own criteria (trusted provider, demonstrable security expertise, actively maintained threat intelligence), sized to what you actually need: a free baseline resolver, a reporting-capable paid tier, or a vendor-backed product with support.

---

Trademarks belong to their respective owners; AdminKit is not affiliated with the NCSC, Quad9 Foundation, NextDNS, Cloudflare, Inc., Control D, or Cisco Systems, Inc.