DNS Filtering
High-Throughput, In-Memory
DNS Filtering Engine
Deterministic name-resolution inspection operating directly on the Layer 2 datapath.
Yazata integrates a dedicated, event-driven DNS inspection engine running locally on the appliance—parsing, validating, and evaluating DNS transactions against millions of threat indicators with sub-millisecond query latency.
The In-Memory Filtering Engine
A dedicated, event-driven DNS inspection engine operating entirely in volatile memory (RAM).
Deterministic name-resolution inspection operating directly on the Layer 2 datapath.
Operating entirely in volatile memory, the engine parses, validates, and evaluates DNS transactions against millions of threat indicators with sub-millisecond query latency—sitting transparently between the client and the resolver, before socket connections are ever formed.
Query Processing Lifecycle
Every outbound DNS query passes through five deterministic stages.
1. Inline Traffic Interception
The Layer 2 transparent bridge intercepts standard outbound DNS queries (UDP/TCP Port 53) directed to any destination IP, rerouting them internally to the local resolver daemon without modifying IP packet headers.
2. Local Cache Evaluation
Queries are instantly checked against an internal, high-speed LRU (Least Recently Used) cache with optimistic caching logic, minimizing upstream round-trip times for repeated queries.
3. Optimized Rule Engine & Trie Matching
Uncached lookups are evaluated against active blocklists using compiled radix-tree (Trie) and hash-map structures. Wildcard rules, domain exact matches, and regular expressions are processed in O(k) time complexity (where k is domain length), independent of total list size.
4. Deterministic Sinkholing
If a match triggers on a malicious, tracking, or ad domain, the engine halts external egress and synthesizes an immediate response (configurable as 0.0.0.0, ::, or NXDOMAIN) with an aggressive TTL to prevent endpoint retry flooding.
5. Multiplexed Upstream Resolution
Legitimate queries are forwarded via encrypted transport (DoH, DoT, or DoQ) to prioritized upstream resolvers. The engine queries fastest-responding nodes concurrently to ensure minimal network overhead.
Key Capabilities
Multi-format rules, encrypted upstream transport, and bypass prevention—compiled directly into memory.
Advanced Pattern Matching
Supports multi-format blocklists: hosts files, Adblock-style syntaxes, domain wildcards (*.example.com), and complex RegEx rules compiled directly into memory structures.
Encrypted Upstream Protocols
Upstream communications bypass unencrypted port 53. Natively supports DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), and DNS-over-QUIC (DoQ) to prevent ISP-level tampering or eavesdropping.
Bypass Prevention & DoH Blocking
Detects and drops unauthorized outbound DoH/DoT connections to third-party public resolvers, preventing rogue endpoints or browser defaults from circumventing central security policies.
EDNS0 & Client Subnet Stripping
Strips EDNS Client Subnet (ECS) metadata from outbound requests to ensure internal private IP layouts and geographic details are never leaked to external nameservers.
Official Query Processing Pipeline:
[ Client Endpoint DNS Query (UDP/TCP Port 53) ] ──► (Layer 2 Transparent Bridge — Header-Preserving Intercept)
│ (Local Resolver Daemon)
▼
[ LOCAL LRU CACHE EVALUATION ] ──► Optimistic Caching, Minimal Round-Trip Time
│ (Cache Miss → Rule Engine)
▼
[ RULE ENGINE: TRIE + HASH-MAP MATCHING ] ──► Wildcards, Exact Match & RegEx — O(k) Complexity
│
▼
[ MATCH ] ──► [ SINKHOLE: 0.0.0.0 / :: / NXDOMAIN ]
[ NO MATCH ] ──► [ ENCRYPTED UPSTREAM: DoH / DoT / DoQ ]
│
▼
[ RESPONSE RETURNED TO CLIENT ENDPOINT — Zero Latency, Zero Client Footprint ]
From interception to resolution, every query is evaluated in-memory at the physical boundary—no software agents, no browser extensions, and no disruption to the endpoint.
Performance Specifications
Engineered for line-rate, non-blocking throughput on dedicated appliance hardware.
Processing Latency
Less than 0.8 ms average internal rule evaluation time.
Throughput Capacity
Multithreaded, non-blocking I/O capable of handling 10,000+ QPS (Queries Per Second) on dedicated appliance hardware.
Memory Footprint
Native compiled binary with optimized memory pooling; maintains 2,000,000+ active rule definitions in under 512 MB RAM.
Zero Client Footprint
Operating strictly at the Layer 2 transport boundary, zero software agents, drivers, or certificate authorities (CAs) are deployed onto managed endpoints.
Network-Wide DNS Filtering.
Zero Client Footprint.
Deploy transparent Layer 2 name-resolution defense without reconfiguring your network subnets, installing software agents, or managing endpoint policies.