When we swapped our ISP-provided DNS servers for OpenDNS, the difference was immediate and dramatic — faster resolution, built-in phishing protection, and granular content filtering.
The problem with ISP DNS: Most ISP resolvers are overloaded, poorly cached, and offer zero security features. They resolve known-malicious domains just as happily as legitimate ones.
What OpenDNS brought:
- Faster recursive resolution via Anycast routing
- Built-in malware and phishing domain blocking
- Category-based content filtering (huge for managed environments)
- DNSSEC validation before it was mainstream
Cisco acquired OpenDNS in 2015 and rebranded it as Umbrella — now one of the most widely deployed DNS security layers in enterprise. The core idea remains the same: DNS is a choke point, and if you control resolution, you control a massive amount of your attack surface.
Modern recommendation: Every organization should be using a security-aware DNS resolver — whether that's Cisco Umbrella, Cloudflare Gateway, or at minimum, Cloudflare's 1.1.1.1 with malware filtering (1.1.1.2).