Sovereign DNS security
KoraxDNS resolves your organisation’s DNS in the EU and refuses the names that lead to malware, phishing and command-and-control — before a packet reaches them. Every refusal lands in the console with the reason it was made, and with the user behind it wherever identity mapping is in place.
The problem
DNS is the one thing every device on your network uses before it does anything else. On most SME networks it is also the one thing nobody is watching.
And now NIS2 is asking what you did, when, and who did it.
How it works
There is no appliance to rack and no agent to package. You change a DNS forwarder on the firewall, router or DHCP scope, and the next query is already being decided.
Point the firewall, router or DHCP scope at KoraxDNS — over plain DNS, or over DNS-over-HTTPS with a token that identifies your organisation. Start with one subnet or a pilot network; nothing else has to change.
Each name is checked against KoraxDB, our threat-intelligence database, and against your own policy: the categories you block, your allowlist, your blocklist. A risky name is refused before the connection is attempted.
The console shows the domain, the category, the action taken, the time, the policy and the source that triggered it — along with the network or user it came from. Not a counter: the event, with its evidence.
Guided onboarding with self-serve trial elements: you sign up, choose a policy, change one resolver, and we stay with you until you can see your own traffic. A new organisation starts in monitor mode: nothing is refused yet, every name that would have been blocked — by a threat detection or by its own blocklist and policies — is flagged, and it starts blocking when it chooses.
Production is hosted only with EU providers, currently OVHcloud, in EU regions, under EU legal jurisdiction.
What KoraxDNS does
Everything below is a screen in the console your trial opens on — not a roadmap and not a capability matrix.
| Value | Why to believe it |
|---|---|
| Blocks by threat category | Malware, phishing, command-and-control and botnet infrastructure, and abuse and spam sources — plus addresses with a bad reputation, whatever name points at them. You choose which categories apply. |
| Tells you why a name was blocked | A threat-intelligence verdict carries its category, the source that supplied it, a confidence, and when the name was first and last seen — so a block can be argued with instead of guessed at. A name on your own blocklist is simply yours. |
| Blocks the address, not just the name | The answer is inspected before it reaches the client: if a name resolves to an address already known for hosting criminal infrastructure, the reply is refused even though the name itself is unknown. |
| Takes your word over ours | Your allowlist wins over any verdict and any block. Your blocklist adds names our sources have not seen yet. |
| Shows who asked, not just what | Agentless Active Directory correlation ties a DNS event to the real user, the device and the subnet. |
| Keeps the record for the audit | A searchable activity feed, monthly NIS2-style reports as PDF, and a tamper-evident audit trail of administrative actions. |
| Protects the networks you do not own | Per-organisation DNS-over-HTTPS tokens, so a roaming laptop or a guest network resolves under your policy. |
| Runs sovereign | Resolution and enforcement happen with EU providers in EU regions, under EU legal jurisdiction. |
What it is not: a DNS-layer product blocks a name before the connection is made. It does not inspect encrypted application content, and it does not replace endpoint detection, data-loss prevention or a SaaS security broker. It reduces exposure to known and suspected risky domains; no DNS filter can promise every unknown threat.
Threat intelligence
A block is only as good as the reason behind it. KoraxDNS weighs every source by how much it has earned, acts on the strength of that evidence, and keeps an allowlist of the world’s busiest domains standing between a noisy feed and your business.
An authenticated feed from a national cyber-security authority, pulled from its live threat-intelligence platform rather than a public export. The highest-trust input in the set, and the one that reflects what is being used against organisations in this region right now.
Phishing confirmed by a national computer emergency response team — names that a public body has already investigated and stands behind.
Licensed feeds of malware domains and malware-hosting addresses, refreshed continuously. Paid for so that you do not have to negotiate, integrate and maintain them yourself.
Open, high-volume sources where malware command-and-control and phishing infrastructure is reported as it is found — the fastest signal, and the one that most needs corroborating.
Feeds of individual addresses with a history of abuse, and of whole network ranges that exist to host crime. These describe infrastructure rather than names, which is what makes them hard to evade by registering a new domain.
The most-visited names on the internet are carried as an explicit allow signal. It is there to stop a noisy feed taking your business offline — a false positive on a name everyone uses is far more expensive than a missed block.
Every source carries a trust weight earned by what it is and how it has behaved. A sighting from a national authority counts for more than an anonymous community report, and the difference is a number in the engine rather than an opinion.
Evidence accumulates. A source that keeps listing a name across successive refreshes counts for more than one that saw it once, and a name carried by more than one source counts for more still. In practice most blocks rest on a single well-weighted source: a national CERT reporting a phishing domain is acted on without waiting for a second opinion.
Evidence ages. A sighting loses weight as it gets older and an expired listing falls out of the corpus entirely, so the corpus reflects what is dangerous now rather than what was dangerous once. Verdicts are recomputed continuously as that happens.
Most DNS filtering stops at the name. KoraxDNS also inspects the answer: the addresses in a reply are checked against the reputation corpus before that reply reaches the client.
An address scored to block turns the reply into NXDOMAIN. Addresses that the evidence only puts under watch stay in the corpus without refusing anything, so the reputation signal can build before it costs anyone a connection.
That matters because a name is cheap and infrastructure is not. An attacker can register a domain nobody has ever seen, but it still has to point somewhere — and the somewhere is usually a machine or a network that is already known.
The first five are enforced from live intelligence today. Advertising and trackers is opt-in, and so is Newly registered domains, and so is each content category: each stays off until an organisation switches it on in the console, under Policies. Newly registered domains is offered with two windows, 7 or 14 days — one window per organisation at a time; the 14-day window includes the 7-day one. Whatever is switched on, your whitelist still wins.
AI service usage
Staff reach AI services from work whether or not there is a policy about it. KoraxDNS shows you which ones, per organisation, from the DNS your network already sends us, by application and by vendor — and lets you block an AI application, such as ChatGPT or Copilot, with one action.
Usage is attributed to the application — ChatGPT, the OpenAI API, Microsoft Copilot, Gemini, Claude, Le Chat — and to the vendor behind it, from a curated, sourced catalogue that gives every hostname a confidence. A hostname we are not confident about is counted but never enforced, and a service reached through a shared apex is seen only through the hostnames that belong to it, so the answer is conservative by construction rather than inflated by a wildcard.
Blocking works per application, not per vendor: block ChatGPT, and chatgpt.com stops resolving for your whole organisation within seconds, while the OpenAI API and openai.com still answer — a block never covers the vendor’s other applications. Before you confirm, the console lists exactly the hostnames that will be refused, and every block asks you to confirm your identity again with a second factor. A hostname below our confidence threshold is observed, never enforced, and your allowlist still wins over any block.
What you see are counts of DNS queries after client caching, not a count of requests, and not a measure of how much anybody used a service.
The resolver sees names, never prompts or files. This is DNS-observed service usage, by application, with optional blocking per AI application — it is not content inspection, and it is not data-loss prevention.
Illustration. Observed from DNS, by application; Block or Allow applies to one application, and your allowlist still wins. Counts are DNS queries after client caching, not requests.
Identity-aware, agentless
An IP address is not an answer. It is the beginning of an investigation you do not have time for.
KoraxDNS correlates Active Directory sign-in events with the addresses on your network, so a DNS event carries the user, the device and the subnet it came from — not just a resolver log line.
That correlation is read through MS-EVEN6, the same native Windows event interface Event Viewer uses. No agent is installed on a domain controller, no WinRM, no PowerShell remoting, nothing for your EDR to quarantine and nothing to re-approve at the next change board.
Identity travels with the query, so a block decision and the report that follows name a person rather than an address.
Where no identity mapping exists, an event still carries its network and site — network DNS alone cannot always name the individual user.
NIS2 and sovereignty
NIS2 asks organisations that never had a compliance programme to show what happened on their network and who did it. That is a logging and retention problem before it is a policy problem.
Administrative actions are written to a hash-chained audit trail, so a gap or an edit is visible rather than silent.
DNS-security events are kept and searchable for the window your plan sets, and the monthly report is generated from them rather than assembled by hand.
Built-in monthly reports for the questions auditors actually ask, as PDF, mailed to the people who need them.
Production is hosted only with EU providers, currently OVHcloud, in EU regions, under EU legal jurisdiction.
To be exact about what goes where: resolving a name means we receive the name, the time and a source identifier, and the user where identity mapping is enabled — that is what a resolver decision is made of. Web page content, HTTP payloads and files are never inspected, because a DNS-layer product does not see them.
The rest of the suite
KoraxDNS stands on its own. These extend it — onto your own hardware, onto laptops that leave the building, and into plain-language questions about your own network.
DNS-security enforcement runs in our sovereign cloud; the appliance is your local resolver, identity layer, and long-term log archive.
The on-prem appliance
DNS, DHCP and IP address management on your own hardware, with identity correlation, an HA pair, network discovery and a tamper-evident audit trail. It forwards to KoraxDNS for enforcement and keeps your records — and your long-term log archive — on your own box.
The roaming agent
Keeps Windows laptops on your DNS policy away from the office, and hands DNS back to the local resolver the moment they return to the corporate network.
On-box AI, on the appliance
Ask your network a question in plain language and get the answer from the appliance itself, grounded in your own DNS, DHCP and IPAM history.
Ask Kora runs on the appliance. Your questions and the data behind the answers stay on the box; nothing is sent to an external AI service.
Pricing
KoraxDNS is sized by the networks you protect. The add-ons are quoted on top, when you want them. Tell us the shape of yours and we will quote it — the capability split is below.
One network, one policy. DNS security you can turn on this week.
Several sites, identity on your DNS events, and the compliance pack.
We run it for you, or your MSP does. Hands off.
Proof
None of these are new commitments made for a web page — they are how the product is built.
Production runs only with EU providers, currently OVHcloud, in EU regions, under EU legal jurisdiction.
A data-processing agreement, and a clear record of which data a resolver decision needs and which data we never see.
Nothing is installed on a domain controller, so there is nothing for an endpoint agent to flag and nothing to exempt.
The capabilities Infoblox and EfficientIP charge enterprise money for, at a price and a complexity an SME can actually carry.
Next step
The trial takes a resolver change and shows you what your network has been asking for. The appliance conversation can follow, or not at all.
