Sig53 early access Request a demo

On-premises DNS security

DNS protection.
Under your control.

Block malicious domains. Keep your logs and policy local. Sig53 fits into your existing network, with signed threat feeds and a rollout you control.

Request a demo See how it works
Inside your networkForwarding mode
1
Your devicesWorkstations, servers, and guest networks
Sig53Local policy + verified threat feeds
2
BlockedStopped locallyMalicious domains receive a policy response.
AllowedYour resolverOther queries continue to your configured upstream.

Your network. Your policy. Your decision.

On-premises by designLocal logs and policy, with no vendor query telemetry
Signed threat feedsCryptographically verified before updates apply
Local policy controlPer-client and per-subnet rules on your hardware
Offline-safe operationFiltering continues when feeds cannot be reached
01

Why on-premises DNS filtering

Keep control of your data

Filtering and query logs run locally, without sending query telemetry to Sig53. Allowed queries go to your configured upstream, or to DNS authorities in recursive mode; those DNS requests can leave your network.

Set policy by client or subnet

Ordered source-IP and subnet rules select enforce, log-only, bypass, or refuse mode. Enforced clients share the appliance's domain lists; independent per-subnet blocklists are not yet available.

Trust the updates you apply

Signed feeds are verified before atomic activation. Configure a pilot subnet in log-only mode to observe matches against the active feeds before enabling enforcement.

Roll out at your own pace

Enable enforcement on one pilot subnet while the rest of the network remains in log-only or passthrough mode. Expand coverage as confidence grows.

02

Three-step deployment workflow

systemd · Docker · packages

Deploy and connect a pilot subnet

Install Sig53 on a Linux host or VM. Point one subnet's DHCP DNS at it. Allowed queries continue to your existing upstream resolver, so no topology replacement is required.

zero traffic disruption

Observe in log-only mode

Review which subscribed feed domains users actually visit. Investigate anything that resembles a false positive while all queries continue resolving normally.

instant overrides

Enable enforcement and expand

Save enforce mode for the pilot subnet and restart the daemon to activate the policy change. Monitor the block log and apply live local allowlist overrides for false positives.

03

Operational safety

Threat feed updates are a common point of failure in DNS filtering deployments. Sig53 treats update safety as a first-order concern, not an afterthought.

Invalid updates never replace active policy

Feed updates pass signature and structural validation. A failed update is discarded while the active feed continues unchanged.

Last-known-good feeds remain on disk

The previous validated version is retained locally. Rollback takes one CLI command or UI action, with no re-download.

Emergency feed disable

Disable a selected feed's rules immediately without a restart. Other enabled feeds and local denylist rules remain active.

Immediate local allowlist overrides

Local allowlist changes take effect within seconds regardless of a feed's classification or update cycle.

04

Your everyday appliance workspace

The Sig53 appliance console is your primary workspace for health, feeds, policies, query activity, overrides, diagnostics, audit, and operations. It runs alongside the resolver and keeps management on your hardware. A separate built-in technical and support interface provides direct daemon access for deeper troubleshooting.

Illustrative local dashboard · sample data enforce
StatusActiveforwarding · DNSSEC
Blocked since start1,2473 feeds active
Feed age2h 14mupdated 09:41 UTC

Top clients

since startup
Client IPQueriesShare
10.0.1.152,84163%
10.0.2.441,20327%
10.0.8.944510%

Feed status

  • curated-malwarev2026.8.24
  • phishing-domainv2026.8.22
  • custom-localv1.0.4

Recent events

  • feed refresh completed
  • policy override added
  • cache generation activated
  • resolver health ready
05

Deployment options

systemd service

Linux

Shell installer running as a dedicated system user with minimal privileges.

Debian package

.deb

Install with dpkg and integrate with apt on Ubuntu and Debian.

RPM package

.rpm

For RHEL 9+, Rocky Linux, and AlmaLinux environments.

Docker

container

Mount configuration and the signed feed cache as local volumes.

Offline bundle

air-gap

Install from a release archive. Provision trusted signing keys and separately signed feeds for isolated networks.

Pilot sizing starting point: 2 vCPU · 2 GB RAM · 20 GB disk on a supported Linux deployment. Validate capacity and package compatibility in your environment. Production DoH requires external TLS termination such as nginx, Caddy, or a load balancer. DoT is on the roadmap.

06

Editions

Sig53 is in early access. Pro pricing is not yet public. Features marked roadmap are planned but not currently available.

Community

Free · self-supported

For teams evaluating on-premises DNS filtering.
  • DNS security resolver
  • Local blocklists
  • Per-subnet enforcement modes
  • Log-only evaluation mode
  • CLI and basic admin API
  • Self-supported operation
  • Licensed web UI
  • Offline signed-feed import
  • Prometheus metrics
  • Support bundle
Request Community demo

Pro

pilot

Early access · contact for pricing

For supervised pilots with licensed management features.
  • Everything in Community
  • Signed remote-feed integration
  • Local web console
  • Basic administrative audit log
  • Prometheus metrics
  • Redacted support bundle
  • roadmap Managed threat intelligence service
  • roadmap Configurable audit retention
  • roadmap SIEM integration
  • roadmap SSO / SAML
Request a demo

Enterprise

Early access · contact for details

Offline licensing and feed workflows, with fleet features planned.
  • Everything in Pro
  • Signed offline feed import
  • Offline feed rollback
  • roadmap HA / failover pair
  • roadmap LDAP / AD RBAC
  • roadmap Multi-site management
  • roadmap Contracted SLA and priority support
Get in touch
07

See Sig53 in action.

Tell us about your environment. Your request goes directly to our team by email, and we’ll follow up to arrange a demo and discuss a pilot on your infrastructure.

  • Explore Docker deployment on your own network
  • See policy controls and DNS diagnostics
  • Discuss a log-only pilot and rollout plan
  • A personal follow-up from our team
Interested edition
One follow-up. No marketing list.

08

Frequently asked questions

Does Sig53 send query data to your servers?

No query telemetry is sent to Sig53. Recent events are held in a bounded in-memory buffer; daemon output can be retained by your local logging system. DNS resolution still sends allowed queries to your chosen upstream or authoritative servers.

Which upstream resolver does it use?

You choose it. Use an internal resolver, a public service such as 9.9.9.9, or your own recursive server. Sig53 adds filtering before allowed queries reach that resolver.

What happens if a feed update fails?

The candidate update is discarded. A version that fails signature or structural validation never replaces active policy, and the last validated feed continues operating.

Can it operate without internet access?

Filtering can continue from retained local feeds. Enterprise licenses enable verified offline feed import. Resolving uncached domains still requires access to an upstream resolver or the relevant DNS authorities.

How do I handle a false positive?

Add the domain to the local allowlist. The override takes effect within seconds and does not wait for another feed cycle. Log-only mode helps identify these cases before enforcement.

Can I evaluate without blocking anything?

Yes. In log-only mode every query resolves normally while Sig53 records what would have been blocked. Enforcement is a separate operator-controlled change.

Can Sig53 run as a recursive resolver?

Yes. Sig53 supports forwarding, recursive, and validating-recursive modes. Forwarding mode integrates with an existing upstream resolver, while recursive modes resolve through the DNS hierarchy directly.

Does it support DNS-over-HTTPS in production?

DoH requires external TLS termination such as nginx, Caddy, or a load balancer. Sig53 listens on HTTP internally. Early-access production setups should be tested thoroughly in your environment.