For years, internet service providers have offered a range of consumer security services. These have typically focused on the endpoint and the home: secure residential gateways, parental controls and bundled antivirus or identity protection services.
What they have not historically done is treat the network itself as the primary enforcement point for security.
That is now changing.
Cybercrime has industrialized. Online fraud and scams are no longer edge cases. They are everyday risks for consumers. At the same time, governments, once cautious about intervening in internet traffic, are increasingly expecting networks to play a more active role in protecting users.
This is where Protective DNS (PDNS) is gaining momentum.
According to the latest HardenStance Briefing: Telco Strategies for Consumer Security report, PDNS is now the fastest-growing consumer security service offered by ISPs. It leverages a control point telcos already operate at scale, DNS, to stop threats before a connection is ever established, without requiring any change in user behavior.
A Natural Enforcement Point
Protective DNS applies threat intelligence directly to DNS queries, preventing users from resolving domains linked to malicious activity or unlawful content.
Because every online interaction begins with DNS, it creates a universal enforcement point. Whether a user clicks a link, installs an app or connects a device, DNS is involved.
By embedding intelligence at this layer, telcos can block:
- Phishing and scam domains
- Malware distribution sites
- Command-and-control infrastructure
- Illegal or regulated content
All of this happens transparently, without requiring software on the device or any action from the user. Security becomes part of the network itself.
HardenStance notes that telcos are increasingly combining endpoint protection, router-level controls and network-based security, with DNS emerging as a critical layer in that architecture.
Why DNS, and Why Now?
DNS is not a new technology, but its role is evolving.
From a technical standpoint, it is already ubiquitous and highly scalable. From a business standpoint, it sits at the intersection of two growing pressures.
The first is regulatory. Governments are introducing requirements around content blocking, online safety and cybercrime prevention, areas where DNS provides an efficient enforcement point.
The second is commercial. Consumers are increasingly concerned about scams, fraud and identity theft, creating demand for services that provide meaningful protection.
HardenStance forecasts steady growth in telco investment in consumer security, with spending expected to reach over $600 million by the end of the decade, reflecting both rising demand and increasing regulatory pressure.
This combination is turning DNS into more than infrastructure. It is becoming a platform for consumer security services.
Regulation Is Raising the Stakes
The shift toward Protective DNS is being accelerated by changes in government policy.
Countries such as Ukraine, Estonia and Latvia have already implemented national PDNS services. In the United Kingdom, initiatives like the National Cyber Security Centre’s (NCSC) Share and Defend and legislation such as the Online Safety Act reflect a broader move toward active intervention.
The scale of the problem is driving this shift.
Global scams are estimated to cost as much as $1 trillion annually,1 with fraud accounting for a significant proportion of all crime in some markets. In the United Kingdom, for example, fraud represents around 40 percent2 of all reported crime.
Against this backdrop, expectations are changing. Networks are no longer seen as neutral conduits. They are increasingly expected to act as a line of defense.
From Obligation to Opportunity
For telcos, this creates a strategic choice.
They can take a reactive approach, implementing controls only when mandated. But this turns security into a cost center, adding operational burden without creating differentiation or revenue.
They can participate in government-led initiatives, which may ease access to threat intelligence but still leave the telco responsible for delivery and ongoing costs.
Or they can take a more proactive path: using DNS as the foundation for consumer security services that not only meet regulatory requirements, but exceed them.
This is where PDNS becomes compelling. It offers a way to turn compliance into capability, and capability into opportunity.
The Intelligence Challenge
The success of this approach depends on one critical factor: threat intelligence quality.
Low-quality or generic feeds introduce false positives, miss emerging threats and ultimately erode trust. At carrier scale, accuracy and coverage are non-negotiable.
What’s required is DNS-native threat intelligence designed specifically to analyze how cybercriminal infrastructure operates and evolves.
Disrupting Cybercrime at Scale
Modern cybercrime is not a collection of isolated attacks. It is an ecosystem.
Domains used for scams, phishing and malware are created and discarded at high velocity. These are the disposable assets that victims encounter.
But beneath them sits a shared, persistent infrastructure that enables cybercrime to operate at scale.
At Infoblox, this infrastructure has been attributed to distinct DNS threat actors, groups that build and operate the systems that underpin large-scale cybercrime. These actors provide the ecosystem that allows campaigns to be launched, scaled and repeated with high efficacy.
This infrastructure does more than deliver malicious content. It enables attackers to profile victims in real time, increasing success rates while also obfuscating activity from security researchers and traditional defenses.
The rise of AI-driven scams is accelerating this further, enabling attackers to scale operations and refine targeting in ways that traditional defenses struggle to match.
DNS sits at the center of this ecosystem.
By analyzing DNS activity at scale, it becomes possible to identify not just individual domains, but the infrastructure patterns and threat actors behind them. This enables a shift from reactive blocking to proactive disruption.
At Infoblox, this has been described as targeting the “drone factory” of cybercrime: not just the outputs, but the machinery and operators that produce them.
For telcos, this is a critical shift. It means protection is no longer about chasing individual threats. It is about degrading the infrastructure that enables them.
Unlocking the Value of DNS Data
Telcos already possess one of the most valuable datasets in cybersecurity: DNS telemetry at scale.
Historically underutilized, this data can enhance detection, improve accuracy and contribute to broader intelligence ecosystems. It also creates an opportunity for telcos to move beyond consuming intelligence to generating it.
If data is the “new oil,” DNS data is one of the richest untapped reserves.
What Comes Next
The direction of travel is clear.
Cybercrime is growing in scale and impact. Governments are increasing expectations. Consumers are demanding better protection.
Protective DNS sits at the intersection of these forces.
What was once limited to a small number of large operators is now expanding globally, with telcos in both developed and emerging markets adopting DNS-based security at scale.
For telcos, the opportunity is significant, but so is the risk of inaction.
Those that move early can define the market, build differentiated services and strengthen their role in the digital ecosystem. Those that wait may find themselves implementing security under pressure, with limited ability to compete.
DNS is no longer just infrastructure.
It is becoming the platform for consumer security.
Footnotes/References
- GASA Global State of Scams Report: $1T Lost to Scams. Harris, Robert. Feedzai. November 16, 2024. https://www.feedzai.com/blog/gasa-global-state-of-scams-report-1t-lost-to-scams/
- https://www.feedzai.com/resource/global-state-of-scams-report-2024/ Crime in England and Wales: year ending September 2025. Office for National Statistics (ONS) Centre for Crime and Justice. January 29, 2026. https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/bulletins/crimeinenglandandwales/yearendingseptember2025
