Security

Each switch on the Security page applies to every device on the profile as soon as you flip it. Security lists are checked after your allowlist: an allowlisted domain is never checked by them (see Policy order).

Switch	Blocks	How
Threat intelligence feeds	domains known to host malware, phishing and command-and-control servers	blocklists from free threat feeds at launch; licensed feeds are planned
Typosquatting protection	look-alike registrations of popular domains, like examp1e.com	generated list
Newly registered domains	domains registered in the last 30 days	list built from registration data
Algorithm-generated domains	machine-generated names malware uses to find its servers	detection in the resolver and lists
IDN homograph attacks	internationalised names that impersonate another domain with look-alike letters	check in the resolver
DNS rebinding protection	public names that answer with private addresses	the answer is checked after resolution; a private address in it turns the answer into a block
Cryptojacking	in-browser cryptocurrency miners	blocklists
Child sexual abuse material	domains on child-protection lists	a designated list

The sources behind every list, their licences and when each was last updated are in the public catalogue: the dashboard’s Privacy page shows it, and so does GET /v1/lists.

Coverage in the beta

Threat intelligence, newly registered domains and CSAM blocking are in the beta scope. DGA, typosquatting, IDN homograph, rebinding and cryptojacking protection are planned (see the comparison); a switch may be present before its list or check ships.

A block from any of these answers with Extended DNS Error 17 (Filtered) and the list’s name, so logs and dig show why. See Block answers.