WatchGuard uses a large number of publicly available sources of information to identify malicious domains. These sources are called domain feeds. DNSWatch uses the domain feeds, along with your Allowlist and Blocklist to determine whether to block access to a domain.
You can view details of the feeds used by DNSWatch in the Domain Feeds page. This information is shown for each feed:
Name of the domain feed and URL of the source. Click the domain name to view a description of the feed.
Number of domains in the feed.
Amount of time since the feed was last updated.
Indicates whether subdomains of domains in the feed are also blocked by DNSWatch.
If DNSWatch denies access to a domain, the name of the domain feed appears in the Domain Analysis tab for the associated alert. For more information about alerts, see View DNSWatch Alert Details.
You can also see the name of a domain feed when you search for a domain. For more information, see Search DNSWatch Domains.
To view domain feeds:
- Select Configure > Feeds.
The Domain Feeds page opens.
- To view a description of a feed, click the feed name.