DNS Protection licenses

To use DNS protection, you must have one of the following licenses:

• Xstream Protection: Includes only the standalone DNS Protection capabilities and doesn't include Sophos Endpoint. This license is Sophos Firewall's Xstream Protection subscription.
• Workspace Protection: Includes Sophos DNS Protection for endpoints. This license is based on the number of devices using DNS Protection.

Both licenses include the DNS over HTTPS feature.

This page describes the license details if you have Sophos Firewall's Xstream Protection subscription. For Workspace Protection license details, see Workspace Protection licenses.

You can check whether your firewall has a DNS Protection license in one of the following ways:

• In Sophos Firewall, go to Administration > Licensing.
• In Sophos Fusion, go to the Firewall Licensing page.

For DNS Protection to appear as a product in Sophos Fusion, you must link your licensed firewall to your Sophos Fusion account. You can do this in one of the following ways:

• Register your firewall using your Sophos Fusion account when you install it. See Set up a new firewall with Sophos Fusion.
• Claim your firewall's serial number under Firewall Licensing in Sophos Fusion. See Claim a firewall.
• Register your firewall for Sophos Fusion firewall management from your firewall's web admin console. See Enable Sophos Fusion management of Sophos Firewall.

Fair use

Use of DNS Protection is subject to the Fair Use limits published in the licensing guidelines. Each DNS Protection license or Workspace Protection license carries a fair use limit and your average daily usage over 30 days must not exceed the sum of the limits for all your licenses. See Licensing Guidelines.

Managing abusive or harmful traffic patterns

DNS Protection is a shared service, and its reliability depends on customer traffic staying within expected patterns. Traffic that is unusually high-volume, malformed, or directed in ways that risk affecting other customers or third-party DNS infrastructure may trigger rapid, automated action — including throttling, filtering, or temporary suspension — ahead of a full investigation. Access is normally restored once the cause is identified and resolved.

Categories of concern

Open DNS resolvers

DNS Protection is licensed for use within your organization. You may use it as the forwarder for a local DNS server, but you may not use it with a server that accepts queries from the Internet in general. When configuring a local DNS server, take care that you do not accidentally open it up to requests from unexpected sources. Open DNS resolvers are quickly discovered and abused by malicious actors in various forms of attack such as distributed denial-of-service attacks on third party domains and infrastructure.

Excessive or abnormal query volume

Sustained or spiking query rates well above what is expected for an account's license may indicate a misconfiguration or compromised device. See the fair use section above for information on how we calculate expected query volumes.

Repeated queries for non-resolving or failing domains

A high proportion of NXDOMAIN, SERVFAIL, or similar responses — especially against the same domain — often signals malware (e.g. domain generation algorithms), retry loops, or misconfigured forwarding. Also, queries without the ‘recursion required’ bit set can cause retry loops and indicate a misconfigured forwarder.

High-volume reverse DNS (PTR) lookups

Bursts of PTR queries are a common signature of misconfigured software or network scanning activity.

Traffic consistent with DNS tunneling

Unusual query names, entropy, or sustained streams to a small set of domains can indicate DNS being used to carry non-DNS data for exfiltration or command-and-control.

Traffic that could implicate the service in attacks on third parties

Query patterns resembling denial-of-service, directory enumeration, amplification, or reflection attempts against external DNS infrastructure are treated with particular urgency, as they risk our resolvers being rate-limited or blocked by third parties — affecting all customers.

What customers can expect

• Where practical, we notify the account contact when action is taken, with a general reason.
• Action may be taken before contact is made, particularly where traffic resembles an active attack.
• We will endeavour to provide information about the attack to assist you with identifying and remedying the root cause.

This list is not exhaustive; similar patterns not listed here may also be acted on.