Security FAQ
The questions security teams ask when evaluating DNS-layer control for agents.
Is DNS-layer control sufficient for AI agents?
DNS is the one egress control point present in every runtime an agent uses: containers, functions, virtual machines, developer workstations and CI runners. It requires no software in the agent and it is not influenced by prompt content. Securd applies per-policy scope, a first-seen hold and threat feed matching at that point, and forwards every decision to your SIEM. It is designed to run alongside your egress firewall, not to replace it.
Architecture →Can an agent bypass the resolver with a hardcoded IP or its own DNS-over-HTTPS client?
A workload that already holds an IP address, or that ships its own DoH client, can attempt to bypass a DNS control. Two egress rules address this: permit port 53 only to the assigned Securd resolvers, and block the public DoH provider category in the policy. Securd publishes the Kubernetes NetworkPolicy, AWS security group, GCP and Azure firewall rules and Docker host rule for each environment. A workload that stops resolving through its policy is visible in the logs.
Kubernetes configuration →How do you prevent false positives from disrupting production agents?
Learning mode records first-seen names without holding them, so a new agent can run a representative workload before enforcement begins. Scope templates pre-approve the model providers, tool hosts and MCP servers in use. Hold time is configured per policy. Held names are exported to the review tool your team already uses.
Scope templates →How does the Greywall differ from Cisco Umbrella's Newly Seen Domains or Zscaler's Newly Observed Domains?
Those categories are global, derived from the vendor's own telemetry, and allow a domain by default once it ages out of the category. The Greywall baseline is maintained per policy inside your compartment. The hold duration is set by your policy, and a held name is not allowed until it is approved or the policy releases it. A feature-by-feature comparison is on the architecture page.
Comparison table →Where is DNS query data stored, and can it be forwarded?
Query data is stored per compartment in the United States. It can be forwarded in real time over syslog, exported in CEF, JSON or CSV, or retrieved through the API. Retention is configurable. Data protection terms are published.
Integrations →What does an agent receive when a destination is held or blocked?
The resolver returns the block page address configured for the policy. The agent receives a normal DNS answer rather than a timeout or NXDOMAIN. Application code can distinguish a held destination from an unavailable service by comparing the answer against that address. Reference implementations are provided for each supported runtime.
Developer library →Does this apply to MCP servers?
Yes. An MCP server is reached by hostname and is subject to the same policy, inventory and hold as any other destination. Securd recommends running MCP server hosts on a separate policy from the agents that call them, so that an approval for one agent does not extend to another.
MCP server hosts →What is the rank field on each event?
Rank is an establishment measure derived from the global DNS graph. Destinations that other systems reference carry a rank; destinations with no inbound references carry none. A first-seen name with no rank warrants review before approval. Rank is included on every event and is available to SIEM rules.
Event reference →What is the exit path if we stop using Securd?
Threat feeds are ingested in STIX, CSV, TXT and JSON from sources you control. Allow and block lists export in full. Log formats are open. Nothing required to continue operating is held in a proprietary format.
Management API →Can an administrator override the Greywall for a single agent?
Yes, at the policy level. The change is recorded in the change log with the user, timestamp and content, and linked to the publish that carried it. Publishes emit config.published and config.failed webhook events, so a policy change is visible to your team as it happens.
Webhooks →Does Securd replace an egress firewall?
No. Securd governs which named services each policy may resolve. Firewall rules govern addresses and ports. Both are required, and Securd events can be consumed by the firewall or its management platform.
Architecture →How are agents on developer workstations and in CI pipelines covered?
A DoH virtual site assigns a roaming runtime to a policy without a static IP or a change to the corporate resolver. Hosted CI runners are covered by a local DoH proxy started in a job step. The virtual site address identifies the policy and is managed as a secret.
DoH virtual sites →Is the pricing on this site the actual pricing?
Yes. Tier names, limits and prices on this site are the same values the console bills against.
Pricing →What does Securd not do?
Securd does not inspect TLS, does not install software on hosts, does not proxy traffic, and does not analyze prompt content. It answers one question per lookup: whether the requesting policy is permitted to resolve that name at that time.
Platform →Evaluate Agent DNS with your own agent traffic
Deploy on a single policy in learning mode and review the results with your security team.