Web and email filtering block threats at different points: suspicious messages before delivery, and dangerous destinations when someone tries to visit them. For North West SMEs comparing services, the practical test is who configures those controls, checks their coverage, and sorts out legitimate traffic caught by mistake.
Web and email filtering explained
Web filtering restricts access to malicious websites; email filtering screens incoming messages for spam, phishing, and malware. DNS filtering checks the domains that devices request, giving businesses another opportunity to block dangerous connections.
As of October 2026, the UK Government’s 2025/2026 Cyber Security Breaches Survey found that 40% of small businesses and 60% of medium-sized businesses identified phishing during the preceding 12 months. Those are UK-wide findings, not North West estimates.
The controls perform different jobs. A message filter assesses an email; a DNS filter can stop a device reaching a destination linked within it.
DNS filtering: coverage and limits
DNS filtering blocks access to domains identified as malicious, but domain-level checks cannot distinguish every safe page from every dangerous page.
The Domain Name System (DNS) translates a domain name into an address a device can reach. As the National Cyber Security Centre (NCSC) explains, protective DNS checks requests and responses against threat information and prevents connections to identified malicious destinations.
Those destinations can include phishing sites, malware sites, and infrastructure that sends instructions to infected devices. DNS filtering checks where a device wants to connect, rather than reading email messages or inspecting every webpage.
The distinction matters when legitimate and malicious pages share a domain. Cloudflare’s HTTP-filtering documentation explains that DNS filtering allows or blocks whole domains, while more granular web filtering can assess full web addresses, including individual page paths. Ask which capability a proposed service actually provides.
Coverage also needs to follow laptops away from the office. A supported roaming agent can keep devices using the approved filtering service at home or at client sites.
DNSFilter describes controls for alternative DNS services and DNS-over-HTTPS, which encrypts DNS requests. Encryption itself is useful; the coverage gap arises when requests bypass the business’s approved filtering service. Check how network settings, remote devices, and browsers are managed.
Email filtering in Microsoft 365
Email filtering should screen messages before delivery, and Microsoft 365 businesses should establish what protection they already have before buying another service.
The NCSC’s phishing guidance recommends server-side filtering for spam, phishing, and malware before messages reach staff. Checks can consider sender addresses and domains, attachment types, and malware detection. Domain authentication also helps assess whether messages come from authorised senders.
Microsoft’s Exchange Online Protection includes anti-spam, anti-malware, anti-spoofing, and quarantine controls, enabled by default. Default handling varies: phishing and malware messages go to quarantine, while spam and bulk email normally go to Junk Email.
That difference affects daily work. Staff may encounter messages in Junk Email, while quarantined messages follow a separate review process. Your provider should explain how legitimate correspondence is recovered and who can approve its release.
Microsoft 365 Business Premium includes two similarly named products with different responsibilities. Microsoft identifies Defender for Office 365 Plan 1 as protection for email and collaboration content. Defender for Business protects devices and endpoints. The word Defender alone does not tell you which protection is being discussed.
Before approving another subscription, ask for a record of your existing licence, active email-security policies, and the person responsible for maintaining them. A licence establishes entitlement; the configured policies show how that protection is applied to your business.
How the filtering layers connect
Email filtering and DNS filtering create separate blocking opportunities, so a message that passes one check can still meet another control when someone follows its link.
Consider a fake supplier email containing a link to a sign-in page. Email filtering assesses the message before delivery. If the message reaches an employee, DNS filtering can block the destination when the device requests its domain, provided the service recognises that destination as malicious.
Microsoft Safe Links adds URL scanning and time-of-click verification through Defender for Office 365 Plans 1 and 2. Email-link checks and DNS destination checks therefore act at different points.
Neither layer recognises every threat. A convincing message may also ask someone to change payment details without visiting a website. Filtering belongs within wider cyber security for SMEs, alongside account protection and staff awareness. Its specific role is to reduce the dangerous messages and destinations staff can encounter.
Comparing managed filtering services
A managed filtering service should make responsibility clear: who deploys protection, maintains policies, monitors activity, and helps when a genuine message or website is blocked.
Use these checks when comparing proposals:
- Coverage: Ask which office networks, supported remote devices, and browsers are protected, and how the provider checks that filtering remains active.
- Policy ownership: Establish who approves changes, reviews blocked activity, and maintains exceptions. A subscription alone does not answer those questions.
- Support: Ask how staff report a blocked supplier portal or missing client instruction, who investigates, and how an approved exception is applied.
- Reporting: Request an explanation of what reports show, who reviews them, and which findings lead to action.
Compatibility deserves particular attention. More filtering subscriptions do not automatically improve protection. Microsoft warns that another service wrapping links before Defender for Office 365 can prevent Safe Links from processing them. Ask your provider to check the order in which email-security services handle messages before adding another layer.
False positives need ongoing attention too. A quarantined customer order can interrupt work. The NCSC identifies the balance between missed threats and overly aggressive blocking, so genuine correspondence caught by filters should inform policy adjustments.
Filtering logs also need boundaries. The Information Commissioner’s Office (ICO) calls for a defined purpose, an appropriate lawful basis, and proportionate monitoring. Staff should understand what is recorded, access should be restricted, and information should be kept only as long as necessary.
The ICO sets no universal retention period for filtering logs. Security filtering also does not provide unrestricted permission to read staff communications. Agree the purpose and access rules before collecting information.
Managed filtering for North West SMEs
Blowfish Technology manages DNS protection and Microsoft 365 email-security configuration from Ormskirk, supporting businesses across Lancashire, Merseyside, Cheshire, and Greater Manchester.
Our managed DNS filtering uses DNSFilter Pro. We handle setup, policy management, and reporting, with a lightweight roaming agent extending protection to supported devices away from the office. Dashboards show blocked requests, threat categories, and browsing patterns, so discussions can focus on what was blocked and what needs attention.
Our Microsoft 365 Business Premium service includes security configuration, ongoing management, monitoring, and support. We review email filtering against your actual mail flow and business needs, including genuine messages caught by filters, rather than treating deployment as the finish line.
Request a web and email filtering review from Blowfish Technology. Provide your user and device numbers, Microsoft 365 subscription details, and remote-working requirements so we can discuss existing protection, the changes needed, and a tailored quotation for managing those controls.
The Blowfish Technology team. Managed IT, cloud services, software development and connectivity for North West businesses since 1999.