Hierarchical Domain Denylisting
Blocking the resolution of any subdomain of a specified domain name.Synonyms: Hierarchical Domain Blacklisting .
How it works
This technique is used to block DNS queries from related domains and subdomains that are unauthorized.
Hierarchical domain blacklisting considers the blacklisting of second level domains and additional sub-domains and specific hosts for a given query value. A denylist is maintained that contains DNS names and corresponding subdomains, including wildcards, that should be blocked for a given lookup.
- The denylist of domain names will have to be maintained and will need to be kept up to date
- Other domains that resolve to the domain of interest for blocking (CNAME, etc).
- Denylists should have identified maintenance cycles to ensure lists are not stale.
The following references were used to develop the Hierarchical Domain Denylisting knowledge-base article.
(Note: the consideration of references does not imply specific functionality exists in an offering.)