A DNS firewall protects a network against malicious DNS entities, but cannot be used to prevent a user from accessing a network resource.
Unlike classic IP and port based filtering, a DNS firewall protects a network against malicious DNS entities. They are not a good choice for preventing users from getting to a network resource (DNS is a poor substitute for IP and port based ACLs), but they can be useful for shielding customers from online threats and taking down domains and/or nameservers associated with botnet C&C domains.
