CyberFOX DNS Filter includes a built-in set of test domains that let you verify whether your filtering policies are working correctly—without visiting real-world websites. Each content category has a dedicated .test.cyberfox.com subdomain that triggers (or confirms the absence of) a block page based on your active policy configuration.

Testing is essential whenever you:

• Start a free trial and confirm that DNS resolution is pointing to CyberFOX.
• Create or modify a filtering policy and want to validate that the correct categories are blocked or allowed.
• Deploy the DNS Filter Agent to a new device or location, and confirm that it is enforcing the expected policy.
• Perform ongoing service monitoring to ensure filtering remains active and correctly applied.

Note: Test domains only validate that a category is blocked or allowed by the active policy. They do not test against live third-party websites.

How It Works

When you visit a test domain (e.g., https://ADULT_SITE_URL), the DNS Filter evaluates the request against the policy assigned to the device or network location making the request:

• If the category is blocked → You will see the CyberFOX block page, a browser security warning, or the site will fail to load—depending on HTTPS/HSTS behavior and whether the Root CA certificate is installed.
• If the category is allowed → The test page will load normally, confirming the category is not being filtered.

This allows administrators to quickly and safely confirm that each category is behaving as expected without exposing users to actual content.

Understanding What You May See When a Domain Is Blocked

The browser result will vary depending on HTTPS behavior and certificate trust. All of the following outcomes indicate DNS Filtering is working correctly:

For a full explanation of HTTPS/HSTS block page behavior, see: Why Block Pages Do Not Appear on Some Websites (HTTPS / HSTS)

Creating a Custom Test Domain Policy

You can also create a custom category and policy for internal testing. This is useful when you want a memorable, company-specific domain to verify that DNS resolution is correctly pointing to the CyberFOX filtering service.

Steps

1. Log in to the CyberFOX Portal at https://app.cyberfox.com.
2. Navigate to Policies → Categories.
3. Click Add Category and name it something recognizable (e.g., DNS Filter Test Domain).
4. Add a dummy domain to the category (e.g., mycompanyblockedpage.com). This domain does not need to exist—it only needs to be resolvable through CyberFOX DNS.
5. Navigate to Policies and create or edit a policy.
6. Add the new DNS Filter Test Domain category to the policy and set it to Block.
7. Assign the policy to the location or device you want to test.
8. On the target device, open a browser and navigate to http://mycompanyblockedpage.com.
9. If the CyberFOX block page appears (or the site fails to load and the domain appears as blocked in Query Logs), DNS is correctly configured and the policy is being enforced.

Content Categories and Definitions

The tables below list every content category available in CyberFOX DNS Filter, along with its description.

Static Categories

Static categories represent standard web content classifications. These are the primary categories used in most filtering policies.

Dynamic Filters

Dynamic filters are threat-intelligence-driven categories that CyberFOX continuously updates to protect against emerging security risks. These categories are strongly recommended for all policies.

Privacy Domains

Privacy domain categories help administrators control tracking, advertising, and uncategorized web traffic. These filters provide an additional privacy layer beyond standard content filtering.

Advanced Use Cases

Validating CIPA Compliance Policies

If your organization requires CIPA (Children's Internet Protection Act) compliance—such as schools or libraries—use the test domains for Adult Content, Gambling, Drugs, Weapons, Terrorism & Hate, and Hacking & Cracking to confirm all mandated categories are actively blocked. Remember to verify enforcement through Query Logs, not just browser output.

Verifying Agent vs. Network-Level Filtering

If you deploy both the CyberFOX DNS Agent on endpoints and network-level DNS filtering at the router/firewall:

1. Test from a device with the agent installed to confirm device-level policy enforcement.
2. Test from a device without the agent (but on the filtered network) to confirm network-level policy enforcement.
3. Compare results to ensure there are no policy conflicts or gaps.
4. Use Query Logs filtered by device or location to compare enforcement behavior side by side.

Best Practices

• Test after every policy change. Always verify your filtering policy after making modifications to ensure categories are blocked or allowed as intended.
• Use test domains instead of live sites. Test domains provide a safe, consistent way to validate filtering without exposing users to potentially harmful or inappropriate content.
• Verify through Query Logs, not just the browser. Visual confirmation in the browser is not a reliable indicator on its own. Always confirm enforcement through Query Logs or the Visibility Report in the CyberFOX Portal.
• Include test domains in your onboarding checklist. When deploying CyberFOX DNS Filter to a new site, device, or customer, include a test step using at least 2–3 test domains to confirm proper DNS configuration and policy enforcement.
• Document your test results. Keep a record of which categories were tested, from which device or location, and the result (blocked or allowed) for audit and compliance purposes.
• Enable all Dynamic Filters. Categories such as Botnet, Malware, Phishing & Deception, and Cryptomining are threat-driven and should be blocked in every policy to maintain baseline security.
• Review Privacy Domains settings. Blocking Advertising and Parked Sites & Domains can improve user experience and reduce exposure to low-quality or deceptive content.
• Set clear expectations with end users. Inform users that block pages may not appear for all blocked websites. For HTTPS/HSTS sites, a browser security warning is expected and still indicates the site is blocked.

Troubleshooting

Test domain loads normally when it should be blocked

If the test domain website loads normally (no block page, no security warning, no connection error), the domain is likely not being filtered. This indicates a configuration or DNS path issue.

• Confirm the domain is blocked in logs. Open the CyberFOX Portal and check Query Logs or the Visibility Report. If the domain does not appear as blocked, the issue is upstream of the browser.
• Check for DNS bypass (DoH). The most common cause of sites loading when they should be blocked is Secure DNS (DNS over HTTPS) in the browser, which bypasses CyberFOX filtering entirely. Disable it in each browser:
  • Chrome / Edge: Settings → Privacy and Security → Security → Use secure DNS → set to Off or With your current service provider.
  • Firefox: Settings → Network Settings → Enable DNS over HTTPS → Off (or set about:config → network.trr.mode = 5).
  • Safari (macOS): System Settings → Network → Details → Advanced → remove any DoH/DoT entries; confirm CyberFOX resolvers are in use.
  • OS-level Secure DNS (Windows 11 / Android / iOS): Disable or ensure it uses CyberFOX profiles.
• Verify the policy assignment. Confirm the correct policy is assigned to the device or location you are testing from. Navigate to Policies in the CyberFOX Portal and check the assignment.
• Check the category status. Ensure the category is set to Block (not Allow or Log Only) in the active policy.
• Confirm DNS is pointing to CyberFOX. Run nslookup against a test domain to verify the DNS response is coming from CyberFOX resolvers:

  nslookup ADULT_CONTENT_URL
  

  If the response does not come from CyberFOX DNS servers, the device may be using a different DNS resolver (e.g., ISP default, Google, Cloudflare).
• Check for DNS caching. Clear the local DNS cache on the device and try again:
  • Windows: ipconfig /flushdns
  • macOS: sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
  • Linux: sudo systemd-resolve --flush-caches
• Check for VPN or proxy interference. If the device is connected to a VPN or using a web proxy, DNS queries may bypass CyberFOX filtering entirely.
• Use the Guided Assistance Wizard. In the CyberFOX Portal, navigate to the Troubleshooting page and launch the Guided Assistance Wizard for the affected device or location. This tool walks through configuration validation step by step.

Browser shows a security warning instead of a block page

This is expected behavior for HTTPS and HSTS-enabled websites and does not indicate a failure in DNS Filtering. The domain is still being blocked before the website loads—the difference is how the browser presents the result based on certificate trust and HTTPS enforcement.

• Why this happens: DNS Filtering redirects blocked domains to a block page service. For HTTPS connections, the browser expects the certificate to match the original domain. Because the block page presents a different certificate, the browser rejects it and displays a security warning (e.g., "Your connection is not private"). HSTS enforcement makes this behavior strict and non-bypassable.
• To display block pages on HTTPS sites: Install the CyberFOX Root CA certificate on the device. If the DNS Filtering Agent is deployed, the Root CA certificate is installed automatically during agent installation. See: Installing the Root CA Certificate for HTTPS Block Pages
• Even with the Root CA installed, some sites with strict HSTS enforcement may still show a browser warning. This is by design and is a sign of correct security posture.
• Confirm enforcement through logs. If the domain appears as blocked in Query Logs or the Visibility Report, DNS Filtering is working as intended regardless of what the browser displays.

For a detailed explanation, see: Why Block Pages Do Not Appear on Some Websites (HTTPS / HSTS)

Test domain shows a block page when it should be allowed

• Check for overlapping policies. If multiple policies are assigned, a higher-priority policy may be blocking the category. Review the policy priority order in the CyberFOX Portal. See: Filtering Policies: Common Issues and Fixes
• Check Dynamic Filters. Some categories (e.g., New Domains) appear in both Dynamic Filters and Privacy Domains. Ensure you are checking the correct filter group.
• Review Domain Overrides. A domain override may be applying a block rule that supersedes the policy category setting.

Behavior differs across devices or locations

• Validate deployment type. Distinguish between location-based filtering (router/firewall/DHCP) and roaming device filtering (agent or DoH profile). These use different DNS paths and policies may differ.
• Check agent status. For roaming devices, confirm the agent is running, check its last check-in time, and verify the assigned policy in the Portal's Troubleshooting page.
• Test across conditions. Try a different browser, a different device, and compare HTTP vs. HTTPS behavior to isolate the variable.

Security & Sync Behavior

• Policy changes propagate in near real time. After saving a policy change in the CyberFOX Portal, allow up to 60 seconds for the change to take effect across all assigned devices and locations.
• Agent-based enforcement takes priority. When the CyberFOX DNS Agent is installed on a device, the agent-level policy overrides any network-level DNS filtering policy for that device.
• Dynamic Filter categories are updated continuously. The threat intelligence behind Botnet, Malware, Phishing & Deception, and other dynamic categories is updated in real time by the CyberFOX security team. Test domains for these categories confirm whether the filter type is enabled, not whether a specific real-world threat is blocked.
• DNS Filtering does not decrypt HTTPS traffic. CyberFOX DNS Filtering operates as a non-intercepting security control at the DNS layer. It does not perform SSL inspection, impersonate destination certificates, or introduce man-in-the-middle behavior. This aligns with modern security principles and avoids weakening encryption protections.

Related Articles

• Quickstart Guide
• Creating Custom Categories
• Creating Custom Policies
• Configuring Block Pages
• Installing the Root CA Certificate for HTTPS Block Pages
• Why Block Pages Do Not Appear on Some Websites (HTTPS / HSTS)
• Configuring Domain Overrides
• Filtering Policies: Common Issues and Fixes
• DNS Filtering Troubleshooting Guide
• Query Logs: Viewing and Filtering DNS Requests
• DNS Filtering: Using the Visibility Report