Block cyber threats before they reach you: DNS resolver explained

Lookalike websites, fake delivery texts, and phishing links are getting harder to spot, and “just don’t click suspicious URLs” is no longer good enough advice. One wrong click can put your money, identity, and your family at risk. OpenMedia explains how Protective DNS, like CIRA Canadian Shield, blocks known cyber threats before they reach you.

*This post is supported by a sponsorship agreement with CIRA, the not-for-profit best known for managing the .CA domain and for championing a secure, accessible internet for all Canadians.

Scams are getting harder to spot

Earlier this summer, we surveyed more than 2,500 Canadians on digital safety challenges, and 80.75% told us that they worry about scams and fraud. We are not imagining these risks. Social engineering attacks are getting more sophisticated, with generative AI tools becoming more accessible to the general public. Scammers now use video and voice generators to create deepfakes and voice clones that impersonate people you know. This makes it really hard to tell whether a request for money truly comes from a family member, or whether your boss is actually asking you to buy gift cards.

Cybercriminals use tactics like stirring fear and urgency, or dangling irresistible opportunities to lure you in with lookalike websites, fake delivery texts, and phishing links. Once you take the bait, they trick you into handing over your sensitive information, or infecting your devices with malware. According to the Canadian Anti-Fraud Centre, Canada reported approximately $351 million in fraud-related losses in the first six months of 2026, including about $58 million from spear phishing.

Spotting every scam by eye is a losing game, especially when AI keeps making scams more convincing. But most of these cyber threats share a weak point — at some stage, scammers need your device to connect to a malicious site. This is where a network-level defence, like a filtering DNS resolver, can step in to give you another layer of protection.

What’s DNS, and what does a resolver do?

To understand how that works, it helps to first know what happens within the split second when you tap a link. Every time you visit a website, your device typically uses the Domain Name System (DNS) like an address book to find its destination. You know the name of the place you want to go (for example, openmedia.org), but computers connect using numeric IP addresses. A DNS resolver is the server that looks up that address on your behalf, so you end up at the right house.

Many households use their Internet Service Provider’s (ISP) DNS resolver. But a standard one is built for speed, not necessarily for your safety. It can hand over the address for any site you ask about, whether that is the legitimate website of your bank or a phishing site that imitates it.

How protective DNS blocks known malicious domains

Most connections start with a lookup, so a protective DNS or DNS firewall that knows which sites are malicious can refuse to answer that query. In the case of CIRA Canadian Shield, this recursive resolver performs the lookup, and checks the name against lists of known malicious domains associated with malware, phishing and botnets before answering.

If your device uses CIRA Canadian Shield’s Protected or Family mode and a domain is on the blocklist, the site won’t load, and you won’t end up at the “wrong house.” That can stop some infections by preventing connections to domains already identified as malicious, adding a layer of protection alongside antivirus programs, updates and safe browsing habits. 

Protective DNS can also help if a device is already compromised. Many kinds of malware use DNS lookups to reach the server that controls them. A botnet is a network of infected devices taking orders from that server, some of which might be yours. Blocking those lookups can cut off that connection! As with scam sites, CIRA Canadian Shield blocks known malicious domains that are already on the blocklists maintained by respected threat intelligence, including Cybertip, VirusTotal and the Canadian Centre for Cyber Security (CCCS).

Who and how they protect you matters

A DNS provider can see the domain names your device asks it to resolve, though not the specific URLs or the contents of the pages you read. Even so, a list of domains can still reveal a lot about your browsing activity. That’s why who runs them and what they do with your data matters!

OpenMedia has partnered with CIRA Canadian Shield because this tool is operated by a Canadian not-for-profit – the same organization that runs the .CA domain – not a foreign company that profits from your attention or from exploiting your privacy. It is 100% Canadian, owned and run with all servers located in Canada.

CIRA promises that your data is not the product, and free means free. CIRA explicitly commits to never selling, leasing or monetizing your personal data or using it to show you ads. No sign-up, no subscription, no personal information retained for any marketing purposes. They only retain user IP addresses and detailed DNS query data for up to 24 hours and then delete after.

It’s not just us extending our trust: Mozilla made CIRA Canadian Shield the default encrypted DNS provider for their Firefox users in Canada. This is truly an endorsement of CIRA Canadian Shield’s privacy, security and transparency practices.

Want more privacy?

Unlike a standard resolver built mainly for speed, CIRA Canadian Shield offers three protection levels that change what happens to those lookups: “Protected” mode adds malicious-domain protection, including malware/phishing and related malicious-domain categories. “Family” mode gives optional adult content filtering. “Private” mode provides privacy-focused DNS resolution without threat filtering.

When you switch to CIRA Canadian Shield, your ISP’s resolver no longer handles your lookups. On its own, though, that doesn’t hide them, because unencrypted lookups still pass through your ISP’s network. To close that gap, you can also turn on encrypted DNS, such as DNS over TLS (DoT) and DNS-over-HTTPS (DoH), which also prevent your ISP from snooping on your lookups or hackers on public Wi-Fi from swapping a real answer for a fake site’s address.

What CIRA Canadian Shield can’t do

No tool catches everything. CIRA Canadian Shield only blocks known threats, so you still need to carefully watch out for brand-new malicious sites. It is also not a VPN, so your IP address stays visible, and your ISP can still see which servers you connect to. It doesn’t replace anti-virus software, and some devices and browsers use their own DNS settings and may skip CIRA Canadian Shield’s filtering.

All that said, we believe this tool can be an important part of your digital health picture. Digital safety shouldn’t mean handing over more of your privacy, or relying on yet another foreign company to keep your data “safe.” Choosing a tool that runs in the public interest, here in Canada, is one way to take back some control, and one more layer between you and cybercriminals. If you’re sold like we are, give yourself extra protection online today! Download CIRA Canadian Shield.

How to set it up?

CIRA Canadian Shield works easily and well across different platforms. Currently, they offer mobile apps for Android devices and iPhone & iPad. Their recently launched desktop version supports macOS and Windows. They also offer browser extensions for Firefox, Chrome, and Edge. You can download the tool for free here.

You can also enable CIRA Canadian Shield on your gaming consoles (such as Xbox One, Nintendo Switch and so on) or on your home network, so every device that connects to your Wi-Fi router is protected from known malicious websites. View CIRA Canadian Shield Configuration Guide. 

Download CIRA Canadian Shield!