Skip to main content

The 10-Day Window: Why proactive DNS filtering is your best defence against modern threats

By Claudia Hill
27 January 2026
4 min read
The 10-Day Window: Why proactive DNS filtering is your best defence against modern threats
Interactive security calculator

DNS threat window calculator

Estimate how many malicious lookups reach devices on your WiFi each month, and how much a newly registered domain policy closes the gap a reactive blocklist leaves open.

1,200
5025,000

Threat assumptions (adjust to your logs)

3
0.520
50%
0%90%
10 days
1 day21 days

Reactive blocklist

Enterprise office and corporate campus

New domains resolve until the feed lists them
Exposure window for a new domain
10 days
Time a new malicious domain can resolve
Malicious lookups per month
108
Phishing, malware and C2 attempts
Reaching devices per month
57
Lookups that resolve and connect
Blocked per month
51
48% fewer than no filtering

Malicious lookups reaching devices, by protection type

No DNS filtering108 per month
Reactive blocklist57 per month
Proactive filtering8 per month

Recommended DNS policy

Block categoriesPhishing, Malware and command-and-control, Newly registered domains, Cryptomining, Adult content
Newly registered domainsBlock or warn for domains under 30 days old until categorised
Encrypted DNS bypassRedirect port 53 to your resolver and block known DoH endpoints, or devices can skip the filter
Regulation and guidanceISO/IEC 27001:2022 Annex A control 8.23 (web filtering) and the NCSC protective DNS guidance.
PerformanceNo inline throughput cost: lookups resolve at normal resolver round-trip time and are cached

Sector threat focus

Credential phishing and malware delivered to staff and guest laptops, plus unsanctioned SaaS sign-ups on the corporate SSID.

Assumptions and method
  • -Monthly malicious lookups = devices / 1,000 x lookups per 1,000 per day x 30 = 1,200 / 1,000 x 3 x 30 = 108. The rate is a planning estimate; replace it with the figure from your own resolver logs.
  • -Reactive blocklist: every lookup to a domain still inside the 10-day feed lag resolves (50% of traffic), plus 5% of older domains the feed has not got.
  • -Proactive filtering: new domains are held by age and real-time scoring, so 10% of young malicious domains are assumed to slip through (aged or compromised legitimate domains), plus the same 5% miss on older ones.
  • -DNS filtering stops the lookup, not the payload. It does not replace endpoint protection, patching or network segmentation.
Want this modelled against your own resolver logs?
Useful? Link to this tool

For the modern IT department, Guest WiFi has evolved from a luxury perk into a fundamental utility. Much like power or HVAC, it is a service that customers, visitors, and contractors simply expect to work seamlessly the moment they enter a building. However, from a security standpoint, this utility creates a massive, unmanaged attack surface.

When you provide open access to a network, you are potentially inviting unvetted hardware and "Shadow IT" onto your infrastructure. Without the ability to install endpoint protection on a guest’s personal device, traditional security perimeters often fall short. This is why a robust DNS filter has become the most critical layer in a modern security stack - it moves the defence to the very first step of a digital connection.

The Race Against the "Zero-Day"

In the world of cybersecurity, speed isn't just a metric; it’s the difference between safety and a catastrophic data breach. Most legacy security solutions rely on reactive blacklisting. In this traditional model, a site is identified as malicious, it is reported to a central authority, it’s added to a global database, and eventually - hours or even days later - your filter blocks it.

The problem? Modern cybercriminals are well aware of this lag. Today’s malware and phishing campaigns are designed to be "disposable". They pop up on fresh domains, do their damage within a 24-hour window, and disappear before they ever hit a standard blacklist.

Purple Shield changes this dynamic through AI-driven threat detection. Rather than waiting for a site to be "reported", our system analyses domain registration patterns, IP reputation, and cryptographic signatures in real-time. This allows Purple Shield to identify and block emerging "zero-day" threats up to 10 days faster than traditional providers. In a landscape where a single malicious link in a guest's browser can lead to ransomware, that 10-day advantage is an eternity.

How DNS Filtering Simplifies IT Operations

IT teams are frequently stretched thin, managing increasingly complex environments with finite resources. The last thing a department needs is another piece of "box" hardware that requires rack space, power, and constant patching. Purple Shield is designed as a cloud-native WiFi content filter that integrates into your existing stack without the "rip and replace" headache.

1. Universal, Network-Wide Protection

Because the filtering happens at the DNS layer (before a connection is even established), the protection is hardware-agnostic. Whether a guest is on a high-end Windows laptop, an older Android tablet, or a brand-new iPhone, the security policy is applied the moment they join your WiFi. You don't need to worry about what OS they are running or whether their patches are up to date.

2. Performance Without Latency

A common complaint with traditional proxy-based filters is that they slow down the user experience by routing traffic through a "middle-man" for inspection. A DNS filter operates differently. It simply checks the destination address against a secure database in milliseconds. Your users get the high-speed experience they expect, and your network remains secure without the bottleneck.

3. Granular Visibility and Analytics

You cannot manage what you cannot see. The Purple Shield dashboard provides IT managers with deep, granular analytics into network behaviour. You can see exactly which categories of threats are being blocked and, more importantly, identify trends. For example, if a specific access point in a lobby is seeing a spike in blocked phishing attempts, it gives your team the data-driven insight to investigate potential localised risks.

Hardening the Edge

In an era of hybrid work and increased mobility, the "perimeter" of your office or venue is no longer a physical wall - it is the digital edge where your users meet the internet. By implementing a proactive DNS filter, you are doing more than just restricting "bad websites". You are hardening that edge, ensuring that your essential WiFi utility doesn't become a backdoor for corporate liability.

The goal isn't just to block content; it’s to provide a robust, secure, and high-quality environment that reflects the professional standards of your organisation.

To find out more about Purple’s Shield solution, please speak to one of our experts. 

‍

Frequently asked questions

What is the 10-day window in cybersecurity and DNS filtering?

The 10-day window refers to the lag between when cybercriminals register fresh domains to execute phishing or ransomware campaigns and when traditional reactive threat feeds identify and blacklist those domains. Disposable attack domains often complete their attacks within 24 to 48 hours, long before legacy blacklists update.

How does proactive AI DNS filtering block zero-day threats?

Proactive DNS filtering like Purple Shield uses real-time artificial intelligence to evaluate domain registration age, DNS entropy, cryptographic certificates, nameserver reputations, and hosting infrastructure at the exact moment a query is made, blocking newly registered malicious domains before they ever appear on static blacklists.

Does DNS-layer filtering cause latency for WiFi guests?

No. DNS-layer security resolves destination hostnames in sub-millisecond speeds across global Anycast networks before a network connection is initiated. Unlike traditional proxy filters and SSL decryption appliances, DNS filtering introduces zero throughput bottlenecks or latency overhead.

Can DNS filtering enforce regulatory compliance across guest WiFi?

Yes. Cloud-managed DNS filtering enables enterprise venues to enforce Friendly WiFi certification, CIPA school safeguarding standards, PCI-DSS guest network isolation, and corporate acceptable use policies by automatically blocking illegal adult content, peer-to-peer sharing, and malicious domains.

Ready to get started?

Book a demo with one of our experts to see how Purple can help you achieve your business goals.

Speak to an expert