Palo Alto Networks Advanced DNS Security review
A focused DNS security layer for teams already operating Palo Alto Networks infrastructure.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Palo Alto Networks Advanced DNS Security is a cloud-based DNS security service for organizations using Palo Alto Networks infrastructure. It analyzes DNS traffic and responses in real time to identify malicious domains, DNS tunneling, command-and-control activity, phishing, malware, and DNS hijacking. Security teams can apply allow, alert, block, or sinkhole actions, review DNS activity, and monitor public-facing domains for misconfiguration. Web, Windows, macOS, and API access are supported, making it suitable for security operations spanning user devices, network controls, and programmatic workflows.
Its strongest differentiator is the depth of DNS-focused detection and response. Administrators can combine real-time threat analysis with detailed query records, activity insights, and a DNS Security dashboard in Strata Cloud Manager. The service also supports DNS over HTTPS and DNS over TLS through Advanced DNS Security Resolver. These capabilities give teams more than simple malware-domain blocking, particularly when investigating tunneling, hijacking, and command-and-control patterns or directing suspicious traffic to a sinkhole.
Platform fit is central to the buying decision. Integrations include Palo Alto Networks NGFW, Prisma Access, VM-Series, CN-Series, Strata Cloud Manager, Prisma Access Agent, and Amazon Route 53 Resolver DNS Firewall. The published offer includes a 90-day free trial, while pricing uses a contact-sales model. Advanced DNS Security requires a Palo Alto Networks subscription and, for some deployments, an Advanced Threat Prevention or Threat Prevention subscription. It is a strong choice for teams standardizing on Palo Alto Networks security products; organizations seeking an infrastructure-neutral DNS service should look elsewhere.
Palo Alto Networks Advanced DNS Security pros and cons
- Where it wins
- Detects hijacking, tunneling, command-and-control, phishing, and malware domains
- Supports allow, alert, block, and sinkhole policy actions
- Integrates with Palo Alto Networks security and resolver products
- Where it doesn't
- Requires a Palo Alto Networks subscription
- Pricing is handled through contact sales
- Its strongest fit depends on Palo Alto Networks infrastructure
Palo Alto Networks Advanced DNS Security fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update