TotalHealDNSGuardDNS Firewall & Security
Stop malware, phishing and DNS tunnelling at the lookup — for every device, on site or on the road.
Trial: 30 days. You sign in to the TotalHeal console with a Sttiz account and activate DNSGuard DNS Firewall. No card.
Most malware, phishing and data-theft traffic starts with a DNS lookup. A protective resolver stops the lookup before a connection is made, for every device on a site or on the road, without an agent on every device.
Threat-blocking protective DNS from the TotalHeal cloud or your own resolver, with blocks and detections landing next to your endpoint alerts. No content-category filtering.
DNSGuard DNS Firewall, feature by feature.
Malware and phishing domains
Known malicious hosts blocked; shared platforms such as GitHub or Drive are never listed, because DNS cannot see a path.
Your own threat intel
Your domains, URL hosts and IP addresses as blocking triggers — up to 50,000 indicators.
Look-alike detection
Typo-squats, swapped letters, homoglyphs (including Cyrillic) and brand-plus-lure names, with Indian banks, payment apps and government portals built in.
New and never-seen domains
Newly registered domains (with a feed) and domains your organisation has never looked up before.
DNS tunnelling and exfiltration
Detected from entropy, label length, record types and volume; detect or block per policy.
Answers are checked too
Every CNAME target and returned address is re-checked.
Policies per network
Allow and block lists, safe search for Google, Bing, DuckDuckGo and YouTube, sinkhole or NXDOMAIN, with a standard “Blocked” error code.
Standard formats
Every list is a standard RPZ zone you can export for BIND, Unbound or PowerDNS. DoH in the cloud; DNS, DoT and DoH on your own resolver.
Never an open resolver, never fails open
Unknown clients refused, rate limits, zone transfers refused; signed policy bundles with last-known-good. Privacy modes per network; BYOD networks never log allowed queries.
How DNSGuard DNS Firewall works.
DNSGuard is a protective resolver, in the TotalHeal cloud or on your own Linux hosts. It blocks malware, phishing and look-alike domains, detects DNS tunnelling, re-checks every answer and lands its detections next to your endpoint alerts — without an agent on every device.
- PointSend devices to the cloud resolver by DoH, or run the resolver on your own Linux host.
- CheckEach lookup is checked against threat lists, your indicators, look-alikes and new domains.
- Re-checkEvery CNAME target and returned address is checked too.
- Block or detectSinkhole or NXDOMAIN with a standard Blocked code, or detect only, per policy.
Platforms and deployment
Platforms
| Platform | How it is covered |
|---|---|
| Cloud resolver (DoH) | Any client that speaks DoH: browsers, macOS/iOS by profile; the TotalHeal app on macOS installs the profile |
| On-premises resolver node | Linux amd64/arm64 with systemd (Professional and Elite) |
Deployment
| Profile | Status |
|---|---|
| SaaS (cloud DoH resolver, India) | AvailableRuns as a test deployment for listed organisations. |
| Hybrid (your resolver, TotalHeal console) | AvailableThe installer stays locked until the release key is published. |
| On-premises control plane | AvailableDelivered with our team from the on-premises kit. |
| Air-gapped | AvailableOffline kit, offline licence file and offline update bundles. |
Essential, Professional or Elite.
Priced per protected user per year. Counted: distinct users or devices seen by the resolver.
| Feature | EssentialUS$18per user per year | ProfessionalUS$36per user per year | EliteUS$54per user per year |
|---|---|---|---|
| Cloud DoH resolver, threat categories, safe search, allow and block lists, tunnelling detection, query log, alerts, RPZ export | |||
| Secure DNS on TotalHeal desktop agents | |||
| On-premises resolvers (DNS, DoT, DoH, block page) | |||
| Threat-actor and campaign intelligence |
List prices per user per year; minimum 25 users. Each tier includes everything in the tier before it. Volume, multi-product and partner pricing on request.
Government profile. Government is a profile, not a separate tier or price list: the Elite tier with Government defaults switched on — data residency in India, four-eyes approval of policy changes, a distinct approver for every approval-level action, retention of at least 180 days, and the CERT-In and DPDP reporting clocks.
What you need
- Cloud: a client that speaks DoH
- On-premises: a Linux host with systemd, outbound HTTPS, a TLS certificate for DoT/DoH, a Professional or Elite licence
Procurement documents for DNSGuard DNS Firewall
The datasheet is public. The full dossier is sent on request, so we can match it to your tender.
- Datasheet. What the product does, platforms, deployment profiles, tiers and honest limits.
- Compliance matrix. Each requirement marked comply, partial or no, with an evidence reference — CERT-In directions, DPDP, ISO 27001 controls touched, accessibility of the console, data residency.
- Bill of materials. SKUs per sizing, the unit and quantity formula, customer-side components and services.
- Architecture and hardening. How the product is deployed and the hardening guidance for each component.
- SLA. Support tiers, response targets the team can meet, update cadence and end-of-life policy.
- OEM authorisation letter. A MAF template for resellers and system integrators, with product names exactly as on the SKU.
Works well with
Part of TotalHeal Secure Access and TotalHeal Edge Defense suites and of Complete — each product is still licensed on its own.
TotalHealZeroGate
Zero Trust Network Access (ZTNA)
Access to named apps and servers only, re-checked continuously — not the whole subnet.
TotalHealPrivilegeVault
Privileged Access Management (PAM)
Vault admin passwords, broker sessions without revealing them, record everything and rotate afterwards.
TotalHealWebShield
Web Application Firewall (WAF)
A web application firewall in front of your portals, tuned without breaking real users.
Get a quote for DNSGuard DNS Firewall.
Tell us how many protected users you need and how you want to deploy. We reply with a quote and the procurement documents you ask for.
Or email business@totalhealsecurity.com.