Unblock domains from security filters

unblock-domain.md

What is this?

When you register a new domain and start hosting content there, people might not be able to view it if they're behind some kind of security software or hardware that filters by domain (e.g. web/content/DNS filters). This is because the domain is new and hasn't been categorized by the security filter, and filters commonly don't allow traffic to uncategorized domains.

Usually people can contact their security provider to request the domain to be unblocked, but:

• this process can take a few days or longer
• sometimes this has to be handled by IT internally and might not be escalated to the provider
  • because of this, sometimes the domain will just be unblocked for a set of people (e.g. everyone at a company) and other companies have to repeat this
• depending on how the filtering is implemented (e.g. how requests/responses are intercepted), websites might just appear broken instead of getting an explicit message about the website being blocked
• usually this approach is reactionary, because people don't know the website is blocked until they try to use the website
  • this is really unfortunate for software-as-a-service because people might not realize the filtering is even active until they sign in to use the software they purchased

Even worse is that some security filters will probably filter by subdomain too, so even new subdomains could be problematic unless there can be some kind of wildcard/pattern categorization for the entire domain.

What we can do

If you've recently registered a domain, you might want to contact common security filters proactively and request that the domain be categorized with some appropriate category.

Doing this proactively might allow you to avoid situations where somebody tries to view your website and hits the security filter (sometimes in non-obvious ways, like the website appearing broken).

Here are some common web/content/DNS filters that companies use:

• Cisco Umbrella
  • Background https://support.umbrella.com/hc/en-us/articles/235911828-Newly-Seen-Domains-Security-Category
  • You can contact Cisco to request the domain to be recategorized, or somebody behind Cisco Umbrella can attempt to view the domain
• Fortinet FortiGate
  • You can check the existing classification through https://www.fortiguard.com/webfilter
  • You can request your domain to be reclassified through https://www.fortiguard.com/faq/wfratingsubmit
• SonicWALL
  • Check existing rating https://www.sonicwall.com/support/knowledge-base/how-to-find-out-the-cfs-rating-of-a-website/170505682966697/
  • You can request the domain to be reevaluated through https://cfssupport.sonicwall.com/Support/web/eng/newui/ratingReview.jsp or following the form in the previous article
• DNSFilter
  • Domain lookup is built into the software and doesn't seem to be available publicly https://help.dnsfilter.com/hc/en-us/articles/1500008108562-Domain-Lookup
  • I tried contacting them to ask about categorization but they said a customer would need to request it instead
  • New domains are automatically removed after 30 days after they've been reistered (assuming they haven't been blocked intentionally outside of this)
• Sophos (e.g. UTM)
  • You can submit your domain through https://support.sophos.com/support/s/filesubmission?language=en_US under "Web Address"
  • I don't know all the software that's relevant to filtering, but I've heard at least UTM is used for filtering at companies
• Quad9
  • Test domain at https://www.quad9.net/result/
  • I don't know how to request unblocks
• Cloudflare
  • Check/request domain categorization at https://radar.cloudflare.com/categorization-feedback/
• NextDNS
  • Background https://help.nextdns.io/t/q6hmvc6/i-found-a-domain-blocked-by-error
  • Newly registered domains may be automatically blocked
  • New domains are automatically removed 30 days after they've been registered (assuming they haven't been blocked intentionally outside of this)
• Mimecast
  • There is a sender feedback form you can fill out at https://community.mimecast.com/s/sender-feedback
    • Apparently only available after a network administrator contacts Mimecast about a mistakenly blocked email - really frustrating policy
• Ironscales
  • Haven't looked into this one yet but just noticed it in the wild for the first time
• Barracuda Reputation System
  • https://www.barracudacentral.org/lookups

@grovesNL I would add Barracuda to this list https://www.barracudacentral.org/lookups

@talloula thank you!