How it works
A resolver that answers most questions normally and declines a specific set. The mechanism in full, including where it stops.
Last updated
The lookup
Opening a website begins with a question. Before any page content moves, the device asks a DNS resolver
to turn a name such as example.com into an IP address. Only once it has an
address can it open a connection.
NetGuard occupies that resolver position. For almost every name it behaves like any other resolver:
it answers from cache if it can, and otherwise asks an upstream resolver and caches the reply. For names
on a list you have enabled it answers NXDOMAIN, which means the name does not
exist. The device gives up before a connection is attempted.
Why NXDOMAIN and not an address
The alternative is to answer with 0.0.0.0, an address that goes nowhere. We
shipped that first and it was a mistake: several routers discard such answers as a rebind attack, and
some clients wait out a full TCP timeout before giving up.
The postmortem is here.
What it covers
Anything that asks DNS, which in practice is nearly everything on a network. That includes devices with no settings screen worth using: televisions, consoles, smart speakers, a guest's phone joining the Wi-Fi.
It covers them because the filtering happens at the network, not on the device. There is nothing to install and nothing to keep updated on each machine.
What it misses
Four things, and it is worth being blunt about each.
- A browser using its own encrypted resolver. DNS over HTTPS lets an application skip the system resolver entirely. Nothing is broken and no error appears; we are simply not asked. See encrypted DNS.
- A VPN. It takes DNS with it. There is no DNS-layer answer to this.
- Mobile data. The filter applies to your network, and a phone that leaves it is unfiltered.
- Anyone with administrator rights. DNS is a setting, and settings can be changed back in under a minute.
The complete version of this list is part of the documentation, not hidden in a footnote.
What we store
Query logging is off by default. The resolver holds answers in memory to serve them quickly; it does not write a record of who asked for what. Why, and what it costs us.
This website keeps a little more, and the privacy policy lists all of it: an account row if you make one, an enquiry if you send one, and a day-salted hash for page counting if you accepted analytics.