Why agents need their own DNS
Agents act on text and hold credentials. Their network access should match their role.
Every outbound action starts with a lookup. Securd is a resolver with a policy per agent. Each policy resolves only what it permits, holds first-seen names, and enforces outside the agent.
Reviewed September 12, 2026.
Open DNS is an exit path for a compromised agent
An agent with an unrestricted resolver can reach any destination an instruction names. Blocklists do not cover destinations that did not exist when the list was built. Egress firewalls operate on addresses and cannot attribute a connection to a specific agent. The following attack patterns exploit this gap.
Prompt injection
Content retrieved by the agent instructs it to send data to an external host. The agent executes the instruction as part of its task.
Poisoned tool descriptions
An MCP server or plugin supplies a tool description that redirects a call to an attacker-controlled endpoint. Every agent that loads the server is affected.
Compromised dependencies
A package update adds an outbound beacon. The agent runtime imports it and the traffic leaves without any change to the agent's instructions.
In each pattern the agent operates within its instructions. A control that evaluates intent will not detect them. A control that evaluates whether the requesting policy has previously resolved the destination detects all three.
Per-policy resolution with a first-seen hold
Compartment, policy, identity. A compartment is a company in Securd: its own policies, identities, logs and first-seen baselines. Inside a compartment, one policy per agent role carries the allow and block lists, category rules and baseline for that role. Each agent instance receives an identity, a DoH address bound to a policy, so every query is attributed to the instance that made it. Identities are unlimited; policies and compartments are the units that carry cost.
First-seen hold. With the Greywall enabled, a name the policy has not previously resolved is held for the configured hold time. During the hold it can be approved or blocked; if neither occurs, the policy determines the outcome when the hold expires. Learning mode records first-seen names without holding them, for use during initial deployment.
Enforcement outside the agent. Policy is applied by the resolver. No SDK, sidecar or proxy is installed in the agent runtime, so there is no component in the runtime for a compromised agent to alter.
Every decision is an event. Accept, block, threat and greywall decisions are logged with the reason, client address, categories and establishment rank. Events forward over syslog, export as CEF or JSON, and are delivered as signed webhooks. Configuration changes are written to a change log with the user, timestamp and content.
Limits, and the egress rules that close them
A DNS control governs what a workload can resolve. A workload that already holds an IP address, or that includes its own DNS-over-HTTPS client, can attempt to bypass it. Both cases are addressed with standard egress rules, which Securd documents for each supported environment.
# Egress rules that accompany a DNS control
# 1. DNS is permitted only to the assigned Securd resolvers
allow udp/53, tcp/53 -> <assigned resolver IPs>
deny udp/53, tcp/53 -> any
# 2. HTTPS is permitted; the DoH provider category is blocked in the
# policy so a hardcoded public DoH URL does not resolve
allow tcp/443 -> any
# (block the "DoH providers" category in the policy)Environment-specific versions of these rules (Kubernetes NetworkPolicy, AWS security group, GCP and Azure firewall rules, Docker host rules) are in the developer library, and the full procedure for a specific agent runtime (Hermes Agent, OpenClaw, OpenHands, Claude Code, Codex CLI, Gemini CLI) is in the deployment standard. A workload that stops resolving through its assigned policy is visible in the logs by the absence of its queries.
Securd does not replace an egress firewall. It governs which named services each policy may resolve; the firewall governs addresses and ports. Securd events can be consumed by the firewall management platform.
Newly-seen-domain categories versus a per-policy baseline
Several products classify domains that are new to the vendor's telemetry. Those categories are global and vendor-defined, and a domain leaves the category as it ages. The Greywall baseline is maintained per policy inside the customer's compartment, the hold duration is set by the policy, and a held name is not allowed until it is approved or the policy releases it.
| Product | Feature | Difference from a per-policy baseline |
|---|---|---|
| Cisco Umbrella | Newly Seen Domains category | Global category derived from Cisco telemetry. Allows by default once the domain ages out. Designed for user web traffic. |
| Zscaler | Newly Observed Domains, Newly Registered Domains | Global categories within a proxy architecture that requires a client or a tunnel. Fleet-scale deployment is measured in months. |
| DNSFilter | New Domains category | Global category. No per-policy baseline, no hold window, no API for pushing verdicts. |
| Cloudflare Gateway | New Domains category | Global category, delivered as part of a platform commitment. No per-policy baseline. |
| Route 53 Resolver DNS Firewall | Managed domain lists | AWS only. List-based rather than first-seen. No hold, no learning mode, no cross-cloud policies. |
Feature names verified against each vendor's public documentation on September 12, 2026.
Deployment and integration
No host software
Deployment is a resolver setting: a VPC DHCP option, a CoreDNS forward, a pod dnsConfig or a DoH URL. The same mechanism applies to containers, functions, workstations and CI runners.
No proxy in the data path
No TLS inspection and no certificates to distribute. Applications that pin certificates are unaffected.
SIEM and SOAR integration
Syslog, CEF, JSON, signed webhooks, and a push API that lets a SOAR playbook block a destination across all policies.
Evaluate Agent DNS with your own agent traffic
Deploy on a single policy in learning mode and review the results with your security team.