Title	Block external domain
ID	RA3103
Description	Block an external domain name from being accessed by corporate assets
Author	@atc_project
Creation Date	2019/01/31
Category	Network
Stage	RS0003: Containment
References	https://en.wikipedia.org/wiki/DNS_sinkhole
Requirements	MS_border_proxy MS_border_ips MS_border_ngfw MS_dns_server

Workflow

Block an external domain name from being accessed by corporate assets, using the most efficient way.

Warning:

• Be careful blocking doman names. Make sure it's not a cloud provider or a hoster. If you would like to block something that is hosted on a well-known cloud provider or on a big hoster doman, you should block (if applicable) a specific URL using alternative Response Action