USOM list in one click
The malicious link list of Turkey's national cyber incident response center (USOM) turns on with one click, with roughly 474 thousand entries.
New · DNS Security · Included in izgate Cloud
DNS Security: block malicious and unwanted sites at the network level.
izgate's own filtering DNS service stops devices on your guest and office networks from reaching gambling, adult content, malware, and phishing domains at the network level. It is included in your izgate Cloud subscription at no extra charge.
- No extra charge, included in izgate Cloud
- Categories and the USOM list switch on and off with one click
- One-click setup on MikroTik, connects to FortiGate
What is DNS filtering?
Stopped at the domain name, before the site is ever opened
Before a device connects to any site, it asks DNS to translate the site's domain name into an IP address. izgate DNS works at exactly that step: when a name in a blocked category or in your custom block list is requested, it does not return the real address. The device either sees a "site not found" result or is sent to a branded block page.
This approach is practical for guest Wi-Fi: you do not need to install anything on each device, because the filter is applied in the network's DNS. Gambling site blocking, adult content blocking, and protection from malware and phishing sites are all managed in one place with category switches.
Categories
You decide which categories to turn on
Each category switches on and off with a single toggle in the panel, and the domains it contains can be viewed. Five categories are on by default.
Gambling and Betting
~279K domains
On by default
Adult Content
~953K domains
On by default
Malware and Hacking
~2.66M domains
On by default
Phishing and Fraud
~455K domains
On by default
Crypto Mining
On by default
Drugs
Off by default
Piracy and Torrents
Off by default
Ads and Trackers
Off by default
USOM malicious link list
~474K links
Turns on with one click
Lists update on their own
Security lists refresh every 6 hours and the others once a day. Sources are openly licensed international threat lists and USOM.
Contents are viewable
Before turning on a category you can look at the domains inside it, so you know exactly what you will block.
Custom block and allow lists
Put your own rules on top of the categories
To block a site that falls outside the categories, or to unblock a site that was blocked by mistake, your company keeps its own block and allow lists. The allow list takes precedence over category blocks.
- Up to 10,000 domainsYou can define your own names for the block list and the allow list separately.
- Subdomains includedWhen you add example.com, subdomains such as www.example.com match as well.
- Companies never affect each otherEach company's settings apply only to its own networks; a name added by one company has no effect on another.
Block list
- ornek-bahis.example
- ornek-oyun.example
Subdomains included
Allow list
- ornek-kurum.example
Overrides categories
Connection
One click on MikroTik, encrypted DNS on FortiGate
Your device connects to izgate DNS over an encrypted channel. Only devices registered with izgate can send queries; it is not open to everyone.
MikroTik: one click with Automatic Setup
On RouterOS 7.19 and later, Automatic Setup configures DNS with one click. The connection uses DoH (DNS over HTTPS) and each device uses its own key.
Internet is not cut off: if the izgate DNS server cannot be reached, the router falls back to normal DNS within about 30 seconds; when the server is back, the filter turns itself on again.
FortiGate: encrypted DNS or guest DHCP
FortiOS 6.2 and later can use DoT (DNS over TLS), and 7.0 and later can use DoH. Alternatively, you can enter the izgate DNS address in your guest network's DHCP settings.
izgate DNS recognizes the querying device by the firewall's public IP address registered with izgate.
Not an open resolver
izgate DNS is not a DNS open to the internet; it answers queries only from devices registered with izgate.
DNSSEC validation is on
DNS answers are verified against forgery with signatures (DNSSEC); validation is switched on.
Server in Turkey
The DNS server is located in Turkey and comes with your izgate Cloud subscription.
Block view
What does a user see when opening a blocked site?
You choose one of two views: "site not found" or a branded block page.
This site can't be reached
The server for ornek-bahis.example could not be found.
Check the address and try again.
C
Access to this site is blocked
This site cannot be reached under organization policy.
- Site
- ornek-bahis.example
- Category
- Gambling and Betting
- Reference no.
- ORNEK-0001
Access is logged under Law No. 5651.
Report a false blockThe HTTPS limit: for sites that open over HTTPS, the branded block page appears cleanly only on organization-managed devices that have your company's root certificate installed. A guest's own phone does not have that certificate, so the browser shows a certificate warning. That is why "site not found" is the default and the recommended view for guest networks; the branded block page works best on devices your organization manages.
What the filter covers: izgate DNS works at the domain level; it blocks or opens a site as a whole and does not filter by page content or the path part of an address. A device using a VPN can bypass this filter.
TimeDomainCategoryDevice
09:41
ornek-bahis.exampleGambling and BettingPhone09:43
ornek-oltalama.examplePhishing and FraudLaptop09:47
ornek-zararli.exampleMalware and HackingTabletCertainUser matched from a connection whose log shows the site name
ProbableUser who made a DNS query at the same time
Blocked and "Who tried?"
See what was blocked, when, and from which device
The Blocked screen lists the attempts blocked in the date range you pick. You can filter by category, device, and domain, see the number of attempts and security threats, and download the list as CSV.
The "Who tried?" link matches a blocked attempt to a user in your logs. A match can be certain (when a connection in the logs shows the site name) or probable (based on the user who made a DNS query at the same time). The two are shown separately, so you know how reliable a match is.
Reporting and records
Blocks are reported and appear in your logs as a category
Malicious Site Blocking Report
Produced as PDF, Excel, or CSV with your company logo, and it can be scheduled daily, weekly, or monthly. See the Reports page for details.
In Alerts and Events
Blocks and false-block reports submitted by users appear in the Alerts and Events feed.
Site category in logs
Logs show the izgate category next to site names. You do not need your firewall's own category license.
Visited site name
Even on shared IPs, you can see which site was opened
Many sites share the same IP address; sites behind networks such as Cloudflare are an example. If a log shows only the destination IP, it is unclear which site was opened.
In that case izgate also records the visited site name. On MikroTik, Automatic Setup takes the site name from the first packets of the connection; on FortiGate the same record comes from a web filter profile. So even on shared IPs, the site name appears in your logs.
Guest portal
An information note on the portal
The guest portal shows a notice that "access is logged under Law No. 5651". When the filter is connected, it also adds the statement that "harmful and inappropriate content is blocked".
For portal design and texts, see the Portal Designs page.
How to get started
Malicious site blocking in four steps
1
Connect the device
On MikroTik, run Automatic Setup; on FortiGate, set up encrypted DNS or enter the izgate DNS address in the guest DHCP.
2
Pick your categories
The default categories come on; turn on others and the USOM list as needed.
3
Enter your own list
Add the domains you want to block or allow to the custom lists.
4
Watch what is blocked
See attempts on the Blocked screen and schedule the Malicious Site Blocking Report.
Legislation
Content filtering systems and public use providers
The Regulation on Internet Public Use Providers asks every public use provider (toplu kullanım sağlayıcı) to use a content-filtering system:
"Konusu suç oluşturan içeriklere erişimi önleyici tedbirleri almak amacıyla içerik filtreleme sistemini kullanmak."
"To use a content-filtering system in order to take measures preventing access to content that constitutes a crime."
Regulation on Internet Public Use Providers, Article 4/1-a — mevzuat.gov.tr — unofficial translation
The definitions article of the Regulation describes a "filtering system" as follows:
"Filtreleme sistemi: İnternet ortamında web adresi, alan adı, IP adresi, kelime ve benzeri kriterlere göre erişimi engelleyen yazılımları ve donanımları,"
"Filtering system: The software and hardware that block access on the internet according to criteria such as web address, domain name, IP address, keyword and the like,"
Regulation on Internet Public Use Providers, Article 3/1-d — mevzuat.gov.tr — unofficial translation
izgate DNS is a filtering system that blocks access by domain name, and it can be used together with your firewall's web filter. We recommend taking your legal counsel's opinion on how the obligations apply to your organization. For the framework, see the Regulation summary and the Law No. 5651 guide.
This page is for information only; for the current text of the legislation, refer to the official source (mevzuat.gov.tr).
Related features
Continue from DNS Security
Reports
Produce or schedule the Malicious Site Blocking Report as PDF, Excel, or CSV.
Alerts and Events
Follow blocks and false-block reports in the unified event feed.
Guest Networks
Set the portal, authentication methods, and session rules for each guest network.
Frequently asked questions
About DNS Security
Which domain categories can be blocked?
Gambling and Betting, Adult Content, Malware and Hacking, Phishing and Fraud, and Crypto Mining are on by default. Drugs, Piracy and Torrents, and Ads and Trackers are off by default; the USOM malicious link list turns on with one click. You can switch any of them on or off in the panel.
What does a user see when a site is blocked?
The default view is "site not found," and it is recommended for guest networks. You can also choose a branded block page carrying your company logo and color; for HTTPS sites this page appears cleanly only on organization-managed devices that have your company's root certificate installed, while a guest's phone shows a browser certificate warning.
Does the internet go down if the izgate DNS server cannot be reached?
Not if you connected with Automatic Setup on MikroTik: the router falls back to normal DNS within about 30 seconds, and the filter turns itself on again when the server returns.
Does it filter by page content or by address path?
No. izgate DNS works at the domain level; it blocks or opens a site as a whole. A device using a VPN can bypass this filter.
Can izgate DNS be used together with the firewall's web filter?
Yes. The firewall's own web filter categories belong to your firewall license and are separate; izgate DNS is a filtering system that blocks by domain name, and the two can be used together.
Can I see who tried to open a blocked site?
Yes. The "Who tried?" link matches a blocked attempt to a user in your logs. The match is shown as certain when a connection in the logs shows the site name, and as probable when it rests on a DNS query made at the same time.
Making your network Law No. 5651 compliant is a one-day job.
Configure izgate Cloud based on your number of firewall devices and storage needs; no setup, get started in minutes. Call us with any questions.