Understanding DNS Filtering: How NoorI Works
A plain-language explanation of what DNS is, how NoorI intercepts it, and exactly what it can and cannot see.
Updated July 2026 · 6 min read
What DNS actually is
Every time a device visits a website, it first has to translate a domain name (like example.com) into an IP address a network can actually route to. That translation step is called a DNS lookup, and it happens before any content is ever loaded — it's effectively asking "where is this?" before "show me this."
Where NoorI fits in
Once a device is enrolled, its DNS lookups are routed through your private NoorI Gateway location instead of your ISP's default resolver. Each lookup is checked against your rules before it's answered — if a domain matches a blocked category, app, or exact domain, the lookup fails on purpose and the device never connects to that site at all.
What this lets NoorI see
Only the domain being looked up, when, and whether it was allowed or blocked. That's the entire surface area of a DNS-level filter.
What it genuinely can't see
DNS lookups don't carry page content, search terms, message text, or files — so none of that is visible to NoorI, structurally, not by policy choice. If a site is allowed, everything that happens on it afterward is between the device and that site, the same as it would be without any filter at all.
Why this approach is different from an app that watches your screen
Because the check happens at the network layer, before a connection is even made, it doesn't depend on an app staying open, staying installed, or successfully detecting what's on screen. It also means NoorI is structurally unable to read the private content of an allowed site — the privacy tradeoff and the effectiveness tradeoff point the same direction.