iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The Malicious Domain Blocking and Reporting (MDBR) service is a cloud-based protective-DNS layer for eligible U.S. state, local, tribal and territorial (SLTT) government organizations. The version most commonly meant by “MDBR” is provided through the Center for Internet Security (CIS) and the Multi-State Information Sharing and Analysis Center (MS-ISAC), with Akamai. It checks DNS requests against malicious-domain data and blocks and logs harmful requests. It is an added security control—not endpoint protection or a complete ransomware defense.
Minnesota IT Services also runs a related, grant-subsidized MDBR program for eligible Minnesota local governments. That is a state-specific implementation, not a nationwide offer. This article distinguishes both programs and the expanded CIS MDBR+ service.
What is the Malicious Domain Blocking and Reporting service?
CIS describes MDBR as “a cloud-based secure DNS solution specifically designed for U.S. SLTT organizations.” In the standard CIS/MS-ISAC implementation, an organization configures its DNS forwarders to send domain lookups to Akamai’s primary and secondary recursive DNS servers. The service checks those requests against known and suspected malicious domains, blocks harmful connections at the DNS layer, and sends participating organizations weekly reports. See the CIS MDBR FAQ.
Because the control acts on DNS lookups, it can help prevent a device from reaching a domain identified as harmful. It does not inspect or clean an infected computer, replace endpoint detection and response, or provide incident response. CIS presents it as an additional layer of protection; it does not establish that MDBR prevents every ransomware infection.
#1 Best Overall
- DUAL-BAND WIFI 6 ROUTER: Wi-Fi 6(802.11ax) technology achieves faster speeds, greater capacity and reduced network congestion compared to the previous gen. All WiFi routers require a separate modem. Dual-Band WiFi routers do not support the 6 GHz band.
- AX1800: Enjoy smoother and more stable streaming, gaming, downloading with 1.8 Gbps total bandwidth (up to 1200 Mbps on 5 GHz and up to 574 Mbps on 2.4 GHz). Performance varies by conditions, distance to devices, and obstacles such as walls.
- CONNECT MORE DEVICES: Wi-Fi 6 technology communicates more data to more devices simultaneously using revolutionary OFDMA technology
- EXTENSIVE COVERAGE: Achieve the strong, reliable WiFi coverage with Archer AX1800 as it focuses signal strength to your devices far away using Beamforming technology, 4 high-gain antennas and an advanced front-end module (FEM) chipset
- OUR CYBERSECURITY COMMITMENT: TP-Link is a signatory of the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Secure-by-Design pledge. This device is designed, built, and maintained, with advanced security as a core requirement.
Who can use MDBR, and is it free?
CIS/MS-ISAC standard MDBR
CIS says the standard service is included with MS-ISAC membership. Its registration information specifies SLTT government entities that are MS-ISAC members. CISA’s service listing likewise describes availability to MS-ISAC government members in partnership with CISA and Akamai. Eligibility is therefore tied to the organization’s government status and membership, not simply to being a U.S. business or individual.
Minnesota’s state program
Minnesota IT Services offers a related MDBR service at no cost to eligible Minnesota local government entities. Its listed audiences include cities, townships, counties, Tribal Nations, school and special districts, and other local entities. The state says the service is subsidized through the federal State and Local Cybersecurity Grant Program (SLCGP), and enrollment requires a contract. These terms apply to Minnesota’s program; they do not establish free access for local governments nationwide. Details are on the Minnesota IT Services MDBR page.
CIS MDBR+
MDBR+ is a distinct expanded offering, not just another name for standard MDBR. CIS lists U.S. SLTT government organizations and private hospitals as eligible audiences. Its MDBR+ service page describes real-time portal reporting, custom policies and allow/deny lists, customizable block pages, and a lightweight agent for off-network device protection. Some expanded Akamai features are also available as paid offerings through CIS CyberMarket; the current price and specific eligibility for an individual upgrade should be confirmed with CIS.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Dual-band Wi-Fi with 5 GHz speeds up to 867 Mbps and 2.4 GHz speeds up to 300 Mbps, delivering 1200 Mbps of total bandwidth¹. Dual-band routers do not support 6 GHz. Performance varies by conditions, distance to devices, and obstacles such as walls.
- Covers up to 1,000 sq. ft. with four external antennas for stable wireless connections and optimal coverage.
- Supports IGMP Proxy/Snooping, Bridge and Tag VLAN to optimize IPTV streaming
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
- Advanced Security with WPA3 - The latest Wi-Fi security protocol, WPA3, brings new capabilities to improve cybersecurity in personal networks
How does MDBR work in practice?
When a device asks its configured DNS resolver for a domain’s address, the organization’s DNS forwarder passes the request to the service’s recursive DNS servers. If the requested domain is identified as malicious, the service blocks the lookup instead of returning the ordinary destination address and records the malicious request. The organization then receives a weekly report under standard MDBR.
Standard MDBR logs details only for malicious requests. CIS says the Akamai platform retains those logs for 30 days. Reported fields include the request timestamp, public NAT location/IP, event category or classification, and requested domain. The records do not identify the specific internal endpoint or standalone user responsible for a request, which limits host-level incident triage.
What does deployment require?
For a typical organization, implementation is a DNS configuration change rather than a hardware installation: configure local DNS forwarders to use Akamai’s primary and secondary recursive DNS servers. CIS says this should take a few minutes. Smaller environments may instead configure DNS on devices or a router, but CIS does not recommend purchasing a router specifically for MDBR.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
The service’s cloud-based design means it is not a physical appliance to install. The key operational decision is whether the organization can direct the relevant DNS traffic through the service and handle the blocking and reporting behavior that follows.
What should an organization check before enrolling?
Blocking starts without a monitor-only phase
Standard MDBR does not offer a monitoring-only mode. An organization cannot first run the standard service purely to observe what it would block before enforcement begins. Plan a change process that accounts for possible business impact and a route for reporting suspected false positives.
DNS over HTTPS is not supported
The CIS FAQ’s stated status is that DNS over HTTPS (DoH) is not supported. Devices or applications that use DoH may therefore not send those lookups through the organization’s MDBR-configured DNS path. Review how managed endpoints and applications resolve names before relying on the service as a consistent DNS control.
Rank #4
- Tri-Band WiFi 6E Router - Up to 5400 Mbps WiFi for faster browsing, streaming, gaming and downloading, all at the same time(6 GHz: 2402 Mbps;5 GHz: 2402 Mbps;2.4 GHz: 574 Mbps)
- WiFi 6E Unleashed – The 6 GHz band brings more bandwidth, faster speeds, and near-zero latency; Enables more responsive gaming and video chatting
- Connect More Devices—True Tri-Band and OFDMA technology increase capacity by 4 times to enable simultaneous transmission to more devices
- Unique Design, More RAM, Better Processing - A unique housing design provides optimal heat dissipation, combined with a 1.0 GHz dual-core CPU and 512 MB High-Speed Memory, the AXE75 is designed for long-term reliability and performance.
- EasyMesh-compatible - Extend network range even more by adding EasyMesh-compatible routers, extenders, or wireless powerline adapters for a seamless, whole-home connection. Eliminate dead zones, drops, and lag as you move across your home.
Standard reporting is weekly, not real-time SIEM forwarding
The standard service does not provide real-time log forwarding to a security information and event management (SIEM) system. CIS provides a weekly report, while MDBR+ advertises real-time portal reporting. Organizations that need event-by-event integration or immediate investigation workflows should verify that their chosen tier supports them.
Some perimeter-device lookups can look like false positives
Firewalls and other perimeter devices may proactively query domains on their own malicious-domain lists. Those requests can appear in MDBR reporting as false positives. CIS suggests routing DNS requests from such devices to another provider where possible. The organization should distinguish these device-generated checks from ordinary user or endpoint traffic when reviewing reports.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Remote coverage and attribution have limits
CIS says remote users can receive blocking protection, but requests from an unknown location may not be associated with the organization’s account for reporting. In addition, standard logs do not identify the machine or person behind an event. MDBR+ advertises off-network protection through an agent; organizations needing that coverage should compare the expanded service rather than assume it is part of standard MDBR.
Best Value
- Dual band router upgrades to 1200 Mbps high speed internet (300mbps for 2.4GHz plus 900Mbps for 5GHz), reducing buffering and ideal for 4K stream
- Full Gigabit Ports - Gigabit Router with 4 Gigabit LAN ports, ideal for any internet plan and allow you to directly connect your wired devices
- Boosted Coverage - Four external antennas equipped with Beamforming technology extend and concentrate the Wi-Fi signals
- MU-MIMO technology - (5GHz band) allows high speeds for multiple devices simultaneously
- Access Point Mode - Supports AP Mode to transform your wired connection into wireless network, an ideal wireless router for home
How should you compare standard MDBR, MDBR+, and Minnesota’s program?
| Offering | Who it serves and cost basis | Reporting and controls | Coverage and operational notes |
|---|---|---|---|
| Standard CIS/MS-ISAC MDBR | Eligible SLTT government entities that are MS-ISAC members; included with membership. | Weekly reports; malicious-request logging retained in Akamai for 30 days; no direct Akamai portal access for members, per the CIS FAQ. | DNS-forwarder configuration; no hardware; no monitoring-only mode, DoH support, or real-time SIEM forwarding stated by CIS. |
| CIS MDBR+ | CIS lists U.S. SLTT governments and private hospitals as eligible; expanded or related Akamai features may be paid through CIS CyberMarket. | Real-time portal reporting, custom policies, allow/deny lists, and customizable block pages are described by CIS; log-retention duration and internal-host identification are not stated on the cited MDBR+ page. | Lightweight agent advertised for off-network device protection; confirm current feature availability and terms with CIS. |
| Minnesota IT Services MDBR | Eligible Minnesota local government entities; no cost under a program subsidized by SLCGP, with an enrollment contract. | Reporting and customization details are not stated on the cited Minnesota program page. | State program; do not assume its terms or eligibility apply outside Minnesota. |
The Missouri Office of Administration’s FY2025 budget request includes a separate “Perimeter Blocks 2023” series labeled “MDBR (DNS malicious domains) Blocked”: 775,859 events in April, 1,163,684 in May, 3,484,638 in June, and 3,501,819 in July. These are Missouri operational counts, not CIS-wide results or an independent efficacy study; they do not show unique devices, incidents, or threats prevented. The figures appear in the Missouri Office of Administration FY2025 budget request, published November 16, 2023.
The official CIS materials cited here do not provide a dated, independent effectiveness statistic for MDBR. Blocking counts alone cannot establish how many infections were avoided.
How are suspected false positives handled?
If an organization believes MDBR blocked a legitimate domain, it should use the process provided through CIS/MS-ISAC support and include the requested domain and relevant event details from its report. CIS’s FAQ addresses false positives, but the published material cited here does not establish a universal resolution time or guarantee that every domain will be allowlisted. For suspected false positives generated by perimeter appliances, first check whether the device is performing its own reputation queries; CIS recommends sending those devices’ DNS requests to another provider where possible.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
