Network Security
DNS security tools that resolve only what you meant (2026)
A 2026 shortlist of resolvers and recursive filters. Public docs, not a sinkhole-abuse cookbook.
Expertise: Network Security · Level: Intermediate · 12 min read
A ZTNA app is not a recursive resolver.
ZTNA opens one app. DNS security decides whether the name resolves at all. Overlap declared. This page is resolvers and filters you operate or subscribe to. I will not publish a sinkhole-for-hire kit.
Six resolvers. Two open recursives. One lab filter. One hosted filter. Two enterprise gates. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Unbound | Validating recursive you can host | BSD-3-Clause |
| Knot Resolver | Modern open recursive with policy modules | GPL-3.0 |
| Pi-hole | Blocklist recursive for a lab you own | EUPL-1.2 |
| NextDNS | Hosted filtered DNS you can still read | Commercial (free tier) |
| Cloudflare Gateway | Filtered DNS on a Zero Trust tenant you already have | Cloudflare terms |
| Cisco Umbrella | Known enterprise recursive filter | Commercial |
Unbound
Best for validating recursive you can host
Unbound is a validating recursive resolver. DNSSEC. Access lists. You run it for networks you own.
Key features
- DNSSEC validation
- You host it
- BSD
- Access control they document
Why we like it
This is the hidden gem when the hole is a resolver you can read, not a logo.
Limits
You staff it. Filtering is extra config. Not a SaaS console.
Knot Resolver
Best for modern open recursive with policy modules
Knot Resolver is a recursive with a policy module story. Lua. You operate it.
Key features
- Policy modules
- DNSSEC
- GPL-3.0
- You host it
Why we like it
Second open recursive so Unbound is not a one-row open shelf.
Limits
You staff it. GPL. Not Umbrella.
Pi-hole
Best for blocklist recursive for a lab you own
Pi-hole is a DNS sinkhole people actually finish installing. Fine on a home or lab net you operate. Not an enterprise SEG.
Key features
- Blocklists
- You host it
- Dashboard
- EUPL-1.2
Why we like it
Honesty. A lot of engineers learned filtered DNS here. Say it is a lab tool when the estate is a company.
Limits
List quality is the product. Easy to break apps. Not a compliance control by itself.
NextDNS
Best for hosted filtered DNS you can still read
NextDNS is hosted resolution with allow and block lists. Config as a page. Good for a small fleet that will not run Unbound.
Key features
- Hosted resolver
- Profiles
- Analytics they document
- Free and paid
Why we like it
When you want Pi-hole without the Raspberry Pi, this is the row.
Limits
You trust their resolve path. Not a full SASE. Logs are a privacy decision.
Cloudflare Gateway
Best for filtered DNS on a Zero Trust tenant you already have
Gateway DNS policies sit in Cloudflare One. Overlap with ZTNA and the WAF estate is declared. Do not buy it twice.
Key features
- DNS policies they document
- Same Zero Trust tenant
- Categories
- Paid SKUs
Why we like it
If WARP is already on the laptop, start here.
Limits
Cloudflare-shaped. Price. A category block is not malware analysis.
Cisco Umbrella
Best for known enterprise recursive filter
Umbrella is the OpenDNS product under Cisco. Roaming client. Categories. Long enterprise memory.
Key features
- Roaming resolver
- Categories they sell
- Cisco estate neighbor
- Commercial
Why we like it
Known shelf. If it is already the resolver, tune lists before you add NextDNS on the side.
Limits
Commercial. Another agent. We did not run a tenant.
What the internet thinks about DNS security
DNS threads treat the resolver as the quiet control. We keep that line. A blocklist is not a license to sinkhole someone else.
Prove Unbound still publishes
Confirm Unbound still publishes. Point a new resolver only at clients you operate.
curl -fsSIL https://nlnetlabs.nl/projects/unbound/about/ | head -n 8FAQs
Does DNS filtering replace ZTNA?
No. DNS can refuse a name. ZTNA opens an app. Link both.
Is Pi-hole enough at work?
For a lab, maybe. For a company fleet, you want logging, policy, and a support path.
Do I need DNSSEC if I filter?
Different jobs. DNSSEC authenticates answers. Filtering refuses names. You can want both.
Is this a scored bake-off?
No.
