What is SafeDNS?

SafeDNS helps protect computers from websites that host malicious software. 

How does SafeDNS work?

SafeDNS provides an alternate IP address for domain names associated with malware distribution. Cornell’s SafeDNS uses a set of known malicious hosts, in addition to an allow-list and deny-list maintained on campus by the IT Security Office.

When a person on a Cornell network or the Cornell VPN clicks a link to a website, the request is sent to the SafeDNS servers. If the website is blocked by SafeDNS, a warning message is displayed. Ads are the most common source of malware, so the Cornell warning will most often appear within an advertising space on the website. (See the following sample image.)

SafeDNS helps protect Cornell computers from websites that host malicious software.

How do I report a legitimate site being blocked by SafeDNS?

If you are attempting to reach a site that you believe is legitimate but it is being blocked by SafeDNS, contact the IT Security Office at security-services@cornell.edu. Include the name of the site and the time you attempted to connect to it. The IT Security Office will analyze the site to see if it should be removed from the list.

Why is the warning only in a small part of the page?

Web pages can include content from other sites, for example advertising banners. Because ads are the most common source of malware, the Cornell warning will most often appear within an advertising space on the website, indicating that a malicious advertisement has been blocked. It does not necessarily mean that the entire page is bad.