Editing DNS to block Facebook

Our company has decided to block Facebook plus various other social networking sites.

I have amended a hosts file which seem to do the trick. However I need to role this out to 80 users. I understand that this can be done via group policy. However, i've also seen people suggest that web sites can be blocked via entries in my windows DNS servers.

Can anybody let me know what I need to do to the DNS to achieve this?
metamaticAsked:
Who is Participating?
 
CWCertus1Connect With a Mentor Commented:
Create a zone called facebook.com and add a www A (host) record pointing somewhere else i.e. 127.0.0.1.

Any user with enough rights on their own machine could get the IP address of the facebook and create a www.facebook.com entry in their own hosts file to get around this.

A better solution would be to use group policy to push internet explorer settings which prevent this (content adviser or trusted sites lockdowns etc.) or buy a purpose made solution for this e.g. webmarshal softwar or a hosted solution like websense - incidentally you can force users to use websense on their work machines at home as it is hosted and they would then have to abide by work guidelines for browsing on company machines at all times.
0
 
dannyyoCommented:
I believe you can just add a "New Host" for that site.  If this is a company, the best way to do it would be to use a firewall with content filtering.  We use sonicwall content filtering at our office and all you have to do is deny the whole category of social networking.
0
 
Swapnil PrajapatiSr. System AdministratorCommented:
You can goto DNS on your server right click Goto Forwarders
Add new forwarder and say it as facebook.com domain give forwarder ip as 127.0.0.1

Once you do it the queries for facebook.com should resolve to local and it should be blockec.
0
Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

 
kf4zmtCommented:
Create a new zone on your dns server called facebook.com and then create an A record that points to a bogus IP address.
0
 
mccrackyCommented:
Put the new DNS server in the DHCP configuration and it should be pushed out automatically as each machine renews it's IP address lease with the DHCP server.
0
 
mccrackyCommented:
Then to make sure that no one uses another DNS to get around the filter, you can block outgoing port 53 (DNS) on your firewall for every machine except your server.
0
 
mccrackyCommented:
Rereading your question, if depends if you host your own DNS server or use another one (like one provided by your ISP).  If you host your own, then you put in a forwarder like someone mentioned above.  If you use your ISP, then you can switch to something like OpenDNS.  Anyway, the way to push out the DNS settings would be through your DHCP server.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.