Cyberattackers often use the Domain Name System (DNS) in their activities. Botnet C&C
servers and phishing websites both use DNS to facilitate connection to or from its victims,
while the protocol does not contain any security countermeasures to thwart such behavior. In
this paper, we examine capabilities of a DNS firewall that would be able to filter access from
the protected network to known malicious domains on the outside network. Considering the
needs of Computer Security Incident Response Teams (CSIRTs), we formulated functional …