About DNSWatch Domain Feeds

WatchGuard uses a large number of publicly available sources of information to identify malicious domains. These sources are called domain feeds. DNSWatch uses the domain feeds, along with your Allowlist and Blocklist to determine whether to block access to a domain.

You can view details of the feeds used by DNSWatch in the Domain Feeds page. This information is shown for each feed:

Feed Name

Name of the domain feed and URL of the source. Click the domain name to view a description of the feed.


Number of domains in the feed.

Last Updated

Amount of time since the feed was last updated.


Indicates whether subdomains of domains in the feed are also blocked by DNSWatch.

If DNSWatch denies access to a domain, the name of the domain feed appears in the Domain Analysis tab for the associated alert. For more information about alerts, go to View DNSWatch Alert Details.

You can also see the name of a domain feed when you search for a domain. For more information, go to Search DNSWatch Domains.

To view domain feeds:

  1. Select Configure > Feeds.
    The Domain Feeds page opens.

Screen shot of DNSWatch Feeds page.

  1. To view a description of a feed, click the feed name.

Related Topics

Manage DNSWatch Blocklist Domains

Manage DNSWatch Allowlist Domains

Manage Filtered Domains