A resolver policy for every agent
Securd is a recursive resolver with a policy per agent, environment or team. Each policy resolves only what it permits, holds first-seen names, and logs every decision. Nothing is installed in the agent.
Capabilities
Compartments, policies, identities
A compartment is a company with its own policies, identities, logs and baselines. One policy per agent role. One identity, a DoH address, per agent instance. Identities are unlimited on every plan.
Greywall
First-seen hold per policy with learning, hold and block modes. Hold time is configured in seconds. A held name is not allowed by default as it ages.
Scope lists and categories
Allow and block lists with source, reference and expiry on every entry. Category rules for classes of destination an agent does not require.
Threat feeds
Customer-supplied feeds in STIX, CSV, TXT or JSON, pulled on a schedule and applied across policies. Matches are logged with categories.
Establishment rank
Every event carries a rank derived from the global DNS graph. A first-seen name with no inbound references carries no rank and warrants review before approval.
Events, forwarding, change log
Syslog, CEF, JSON, API retrieval, six signed webhook events and a push API for SOAR verdicts. Every configuration change is logged with user, timestamp and content, with rollback to any publish.
Visibility
Dashboard
Every resolution and decision, with 17 filter fields, a time picker, query volumes, threat breakdowns and held names by policy.
Inventory
Every hostname each policy has resolved: model APIs, MCP servers, tool endpoints and data sources.
Review queue
Held names with the policy, query count, first timestamp and rank. Approve or block from the console, the API, or a chat integration.
Change log
Every configuration change with user, timestamp and content, linked to the publish that applied it. Exportable, with rollback to any previous publish.
Forwarding
Syslog forwarding, scheduled CEF, JSON and CSV export, six signed webhook events and a push API for verdicts.
Reports
Ten PDF report templates, including executive threat protection and ROI summaries.
Deployment
No software in the agent, no proxy in the data path, no hardware. Deployment is a resolver setting. Configuration for each environment is in the developer library.
Cloud VPC
A DHCP option set on AWS, a forwarding zone on GCP, or custom DNS on an Azure VNet. The VPC egress IP identifies the site.
Kubernetes
dnsConfig on the pod for a per-namespace policy, or a CoreDNS forward for the cluster. A NetworkPolicy restricts DNS egress to the assigned resolvers.
Docker and VMs
A dns flag per container, or systemd-resolved on the host. Two agents on one machine can be assigned to two policies.
Roaming and CI
A DoH virtual site assigns a workstation runtime or a hosted CI job to a policy without a static IP.
Scope of a DNS-layer control
A DNS control governs what a workload can resolve. A workload that already holds an IP address, or that includes its own DNS-over-HTTPS client, can attempt to bypass it. Two egress rules address this: permit port 53 only to the assigned Securd resolvers, and block the public DoH provider category in the policy. Rules for each environment are in the developer library. Securd is designed to operate alongside an egress firewall and to supply it with events.
No TLS inspection
No certificates to distribute. Applications that pin certificates are unaffected.
No host software
The same resolver setting applies to containers, functions, workstations and CI runners.
No prompt analysis
Securd evaluates whether the requesting policy is permitted to resolve the requested name, and nothing else.
Infrastructure
Anycast
Global resolver network
Resolver
Policy evaluated at the lookup
On change
Policy publish to the network
SLA
Service level agreement published
Evaluate Agent DNS with your own agent traffic
Deploy on a single policy in learning mode and review the results with your security team.