Protective DNS for devices that can't protect themselves
AdminKit Protective DNS is a filtering resolver that Netbase builds and runs for your network as a custom engagement: it blocks known-malicious and command-and-control domains per site or per device and logs every block, so a compromised camera, till or thermostat can't quietly call home — for shops, offices, MSPs and small industrial sites.
Updated
At a glance
What problem does Protective DNS solve?
Most devices on a home, shop, or factory network resolve DNS through whatever the router hands out, usually without any filtering at all. If a device is compromised, one of the first things it typically does is look up a domain to fetch instructions or exfiltrate data. A resolver that doesn’t check what it’s being asked to resolve has no way to catch that.
Smart TVs, cameras, point-of-sale terminals, and sensors rarely run endpoint security software, so there’s no agent on the device itself watching for this. The network layer is often the only place left to notice when a device starts querying domains it has no business talking to.
Most people also don’t know which DNS resolver their devices are actually using, or whether it does any filtering at all. ISP-provided resolvers and factory-default router settings usually apply no protective logic.
Who is Protective DNS for?
Shops and small offices
Point-of-sale systems and cameras on the same network as everything else, with no security software of their own.
See the solution →
MSPs
One filtering resolver and one block log across many client sites.
See the solution →
Factories and small industrial sites
A lightweight way to catch devices reaching out to domains they have no business talking to.
See the solution →
Households with many smart devices
The same filtering for TVs, cameras and thermostats, set up remotely by Netbase.
See the solution →
How does Protective DNS work?
Devices (or the router) send DNS queries to the AdminKit resolver instead of an unfiltered one. For each query, the resolver works out which site or device it came from, checks the domain against the block policy for that scope — known-malicious and command-and-control lists plus any rules you add — and either answers normally or blocks the lookup. Every block is recorded as an event, so you can review what each device tried to reach.
Devices query the resolver
Routers or devices point their DNS at the AdminKit resolver, over plain DNS or DNS over HTTPS.
The scope is identified
Each query is attributed to a site or, where your network separates them, to a single device.
The policy is checked
The domain is matched against known-malicious and command-and-control lists plus your own rules for that scope.
Answer or block
Allowed lookups resolve as normal. Blocked ones never reach the real address and are logged as an event.
What do you get with Protective DNS?
Malicious domains blocked
Lookups for known-malicious and command-and-control domains are stopped before a device can connect.
Block lists plus your own rules
Policy per site or device
Different rules for the till network, the cameras and the guest Wi-Fi, where your network separates them.
Scope from the DoH address or client ID
A log of every block
See which site or device tried to reach which domain, and when, so a compromised device stands out.
Block events per site or device
Encrypted DNS where supported
Devices that support it can query over DNS over HTTPS, and the per-device scope can come from that address.
DoH (RFC 8484); DoT (RFC 7858) per engagement
No new router
Devices or the router point their DNS settings at the resolver, like any other DNS provider.
Standard DNS settings
Domain names only
The resolver sees the names your devices look up, not page content, IP payloads or traffic that bypasses it.
Privacy by design
What does an engagement include?
| Part of the engagement | What Netbase does |
|---|---|
| Scoping | Map your sites, devices and how they are separated (VLANs, per-device DNS, DoH) |
| Resolver | Deploy and operate the filtering resolver for your sites |
| Block policy | Known-malicious and command-and-control lists, plus your own site or device rules |
| Block log | Every blocked lookup recorded per site or device, for review |
| Switch-over | Point routers or devices at the resolver, with a fallback plan |
Protective DNS only ever sees the domain names sent to the resolver you configure, nothing else. If a device uses a hardcoded DNS server or a different protocol entirely, those queries won’t pass through it, and there’s nothing for it to check. Talk to our team to scope it for your network.
A one-time IP check only tells you the state today — if your connection’s address changes often (dynamic IP or CGNAT), see dynamic IP vs CGNAT vs static: what it means for long-term monitoring for why something watching continuously matters more than a point-in-time lookup. Reference: honeypot. See also AdminKit vs NextDNS / Control D for how this compares to other protective-DNS options.
Is there an option for UK small businesses?
The UK’s NCSC runs its own free Protective DNS service, but it’s built for the public sector and, since October 2023, schools — not for a typical small business. NCSC’s own guidance for the private sector points those organisations toward a commercially procured protective DNS service instead. See protective DNS for UK small businesses for exactly who NCSC’s service covers, what a UK SME can buy or use for free, and where AdminKit Protective DNS — delivered by Netbase as a custom engagement — fits into that picture.
What does Protective DNS work with?
Standards it speaks
- DNS
- DNS over HTTPS (RFC 8484)
- DNS over TLS (RFC 7858)
Using and able to integrate
- CoreDNS
- Your existing router's DNS settings
- VLAN or per-device DNS separation
Who builds and supports Protective DNS?
AdminKit is a product of Netbase JSC, a software company founded in 2012 that delivers its projects remotely. The same team that wrote Protective DNS scopes, builds and operates it for you. Read more about Netbase JSC and AdminKit.
What Netbase JSC's clients say
Reviews of Netbase JSC's project work, not of AdminKit — AdminKit is a newer product from the same company.
"They had nice and good solutions for all of our requests."
Daniel Popescu
Owner, Digital Art Studio · Romania
Source: Clutch"They’re good listeners, are understanding, and they remember things very well."
Syed Ali
Partner, Oriental Overseas Exports · India
Source: Clutch"Their Quick response in every step was impressive."
Olof Christensson
CEO, Skelderwikens Brygghus AB · Sweden
Source: ClutchHow does Netbase deliver Protective DNS?
Protective DNS is delivered by Netbase as a scoped engagement, quoted per project. Every engagement follows the same four steps.
Scope
We map your sites, devices and how they are separated (VLANs, per-device DNS, DoH), and agree where the resolver runs.
Build
Netbase deploys the filtering resolver with the block lists and your site or device rules.
Switch over
We point routers or devices at the resolver, with a fallback plan if anything misbehaves.
Operate
Netbase runs the resolver afterwards and reviews the block log with you.
Netbase expert service
Home / shop security check
A lighter starting point: a remote review of your router, cameras and point-of-sale devices, covering what is exposed and what to fix first.
Does Protective DNS fit a larger organisation?
- Many sites under one block policy, with a block log per site.
- Per-device attribution wherever your network separates devices.
- Resolver placement agreed with you during scoping.
- Every deployment scoped and quoted per engagement.
Talk to an expert
Huy Nguyen (David), Founder & CEO, Netbase JSC
Ask about Protective DNS for your organisation: scope, timeline or a quote.
What do people ask about Protective DNS?
How do I get AdminKit Protective DNS?
Talk to our team at /contact/. Netbase scopes the engagement with you — how many sites and devices, which networks can be separated, where the resolver should run — then builds, deploys and operates the resolver for you. There is no self-serve sign-up for this layer; every deployment is quoted per engagement.
What will Protective DNS actually see?
Only the domain names queried through the resolver your devices are pointed at. It does not see page content, IP payloads, or any traffic that bypasses the resolver.
Do I need to replace my router?
No. Devices or the router point their DNS settings at the AdminKit resolver, the same way you'd point them at any other DNS provider.
Can it tell me which device made a bad query?
Only if your network separates devices, for example with distinct VLANs, per-device DNS settings or a per-device DNS over HTTPS address. If every device shares one DNS path, you get one combined view per site instead of a per-device breakdown.
Can devices use encrypted DNS?
Yes, where the devices support it. DNS over HTTPS (RFC 8484) is supported, and the per-device scope can come from the DoH address each device uses. DNS over TLS (RFC 7858) is set up per engagement depending on what your devices and router support.
Where should you go next?
All AdminKit products →Product
Secure MQTT Broker with Auth and ACLs
Netbase sets up and runs a managed MQTT broker for you with required authentication and default-deny, per-topic access control.
Solution
Find out why your office email lands in spam or your IP gets flagged
Small offices can check email authentication and network exposure for free with AdminKit, and have Netbase configure and protect the office network for you.
Guide
Protective DNS for UK small businesses: what's actually available
NCSC's free Protective DNS covers the public sector and schools, not general small businesses — what a UK SME can buy or use instead, and where AdminKit fits.
Talk to our team about Protective DNS
Tell us what you run. Our team scopes the work with you and sends a quote, answered by a person.
How AdminKit works with you
- Delivered remotely — Netbase JSC, the company behind AdminKit, has worked with clients in 80 countries.
- Contracts and invoices are issued by Netbase JSC; payment goes to the company by bank transfer to Netbase JSC's company account or PayPal Business.
- Talk to the CEO, Huy Nguyen (David), directly on WhatsApp or by email at [email protected].