Your AI agents can reach anything.
Give them only what they need.
Securd Agent DNS gives each agent its own resolver policy. Approved destinations resolve. Anything new is held for review. It runs in the network, so an agent that goes off script cannot switch it off.
Deploys as a resolver setting. No SDK, sidecar or proxy.
Sample agent connections
Open DNS is an exit path
for a compromised agent
Every tool call, model call and data fetch begins with a DNS lookup. An agent with an unrestricted resolver can reach any destination a prompt injection, poisoned tool description or compromised dependency names. Blocklists do not cover destinations that did not exist when the list was built. Egress firewalls cannot attribute a connection to a specific agent.
Architecture and limitsScope per policy
Each agent is assigned a policy that resolves only its approved destinations. An invoice agent resolves the ERP and the payment API and nothing else.
First-seen names are held
The Greywall holds names the policy has not previously resolved. Held names are approved, blocked, or released when the hold expires.
Enforced outside the agent
Policy is applied by the resolver, not by code in the agent runtime. A compromised agent receives the same answers as an intact one.
Deployment in three steps
A resolver setting, a period of observation, then policy enforcement. No SDK in the agent and no proxy in the data path.
Assign the resolver
A VPC DHCP option, a CoreDNS forward, a dnsConfig on the pod, or a DoH URL in the runtime. No software is installed.
Review the inventory
The policy records every hostname the agent resolves: model APIs, MCP servers, tool endpoints and data sources. Learning mode records first-seen names without holding them.
Enforce the policy
Approve required destinations, block the rest, and enable the Greywall hold for new names. Every decision is logged and forwarded to your SIEM.
Platform capabilities
All capabilities listed are available in the current release.
Compartments, policies, identities
A compartment is a company with its own policies, logs and baselines. One policy per agent role. One identity, a DoH address, per agent instance. Identities are unlimited.
Greywall
First-seen hold per policy. Learning mode records, hold mode delays for a configured time, block mode denies until approved.
Scope lists
Allow and block lists per policy, with source, reference and expiry on every entry. Templates for common model providers, tool hosts and MCP servers.
Threat feeds
Customer-supplied feeds in STIX, CSV, TXT or JSON, pulled on a schedule and applied across policies. Matches are logged with categories.
Events and forwarding
Syslog forwarding, CEF, JSON and CSV export, API retrieval, six signed webhook events, and a push API for SOAR verdicts.
Change log
Every configuration change recorded with user, timestamp and content, linked to the publish that applied it. Rollback to any previous publish.
Developer library
Reference code for Python, TypeScript, Go, Java, .NET and Rust runtimes. Configuration for Kubernetes, Docker, AWS, GCP, Azure and CI.
MSSP hierarchy
An MSSP parent publishes global lists into each tenant compartment. White-label options for service providers.
Securd operates at DNS resolution only
Securd evaluates one question for each lookup: whether the requesting policy is permitted to resolve the requested name. This is why deployment is a resolver setting and why the control is not affected by changes inside the agent runtime.
No TLS inspection
No certificates to distribute. Applications that pin certificates are unaffected.
No host software
The same resolver setting applies to containers, functions, workstations and CI runners.
No proxy in the data path
Traffic is not routed through Securd. The only added latency is DNS resolution.
The limits of a DNS-layer control and the accompanying egress rules are documented on the Why Agent DNS page.
Solutions
Agent Connection Control
Discover, scope, and govern every outbound agent connection. Compliance for EU AI Act, CMMC, NIST AI RMF.
MCP Server Governance
Govern which MCP servers your agents can reach. Approve official tools. Block unknown servers.
AI Asset Inventory
Find every AI tool, agent endpoint, and MCP server in 24 hours. No agents. No proxies.
Greywall
First-seen hold per policy with learning, hold and block modes.
Agent Zero Trust
Default-deny network access for agents, enforced outside the agent runtime.
AI Compliance & Audit
Connection-layer evidence for EU AI Act, CMMC, NIST 800-171, NIST AI RMF.
Built for Teams Deploying AI
One policy per agent
An invoice agent requires the ERP API and the payment processor. A research agent requires a model provider and a search tool. Neither requires access to the rest of the internet, and neither should be able to reach it on the basis of an instruction in retrieved content.
Deployed as a resolver setting with no software in the agent.
First-seen names are held; learning mode records them during initial deployment.
Every decision logged and forwarded to your SIEM.
Common Questions
What is Securd Agent DNS?
A recursive DNS resolver with a policy per AI agent, environment or team. Each policy resolves only the destinations it permits. First-seen names are held at the Greywall. Enforcement is performed by the resolver, outside the agent runtime, and deployment requires no software in the agent.
How does the Greywall work?
It holds any name a policy has not previously resolved, for a configured hold time. One policy per agent gives each agent an independent baseline. Learning mode records first-seen names without holding them during initial deployment. Held names are approved, blocked, or released according to policy; a held name is not allowed by default as it ages.
How is this different from a newly-seen-domains category?
Those categories are global and derived from the vendor's telemetry. The Greywall baseline is maintained per policy inside your compartment, the hold duration is set by the policy, and enforcement is performed outside the agent. A feature-by-feature comparison is on the Why Agent DNS page.
What does an agent see when a destination is held?
A DNS answer containing the block page address configured for the policy, rather than a timeout. Application code can distinguish a held destination from an unavailable service by comparing the answer against that address. Reference implementations are in the developer library.
How is Securd priced?
Annual plans measured in compartments, policies, deduplicated events, storage and forwarding. Agent identities are unlimited. MSSP plans are priced per tenant. Plan details are on the pricing page.
Where do the logs go?
Events forward over syslog, export as CEF, JSON or CSV, and are available through the API and as six signed webhook events. A push API accepts verdicts from a SOAR. Configuration changes are written to a change log with the user, timestamp and content.
Evaluate Agent DNS with your own agent traffic
Deploy on a single policy in learning mode and review the results with your security team.