Logo

Deployment Options

  • Whalebone Immunity
    • Local DNS forwarder
  • Cloud deployment
    • Use existing DNS to forward to Whalebone Cloud DNS
    • Cloud DNS (direct connection)

Quickstart

  • Quickstart
    • Creating the portal account
    • DNS traffic view

Configuration

  • Local resolver
    • Local resolver system requirements
      • Hardware and software requirements
      • Hardware sizing recommendations
      • Network requirements
    • Installation of a new local resolver
      • Verifying the installation
      • Securing your resolver
  • Resolver management
    • Resolvers overview
    • Deploy configuration
    • Configure Policy per Network Segment
    • Configure Blocking Pages
    • Upgrade or Rollback a Resolver
  • Security policies
    • Malicious filtering tresholds
    • Types of threats
    • Allow lists
    • Deny lists
    • Regulatory restrictions
    • Content filtering
      • Safe Search
      • Filtering schedule
    • Filter priorities
  • DNS resolution configuration
  • Knot Resolver - Tips & Tricks
    • Allow particular IP ranges
    • Refuse particular IP ranges
    • Allow list of domains
    • Deny list of domains
    • Disable DNSSEC globally
    • Disable DNSSEC validation for a domain
    • Disable Query Case Randomization
    • Disable QNAME Minimization
    • Disable Domain caching
    • Enable Prometheus Metrics
  • Blocking Pages
    • Signing Blocking Pages with a Certificate Authority
      • Prerequisites
      • Admin Portal Configuration
      • Certificate Authority creation and configuration
  • Resolver agent
    • Command line interface
    • Strict mode
  • Cloud DNS resolvers
  • Uninstalling a local resolver

Data Analysis

  • Data Analysis
  • Content
    • Filtering Options
    • Domain Categorization Change
    • CSV Export
  • DNS Traffic
    • Filtering Options
    • Extended DNS Error (EDE) Codes
    • How to Report “False Negative”
    • CSV Export
  • Threats
    • How to Search for Events Blocked by a Deny List
    • How to Analyze a Domain
    • How to Report “False Positive”
    • Filtering Options
    • CSV Export
  • Domain resolution analysis
    • Developer Tools guide
    • Google Chrome
    • Mozilla Firefox
    • Microsoft Edge

Alerting and Reporting

  • Reports
  • Alerts
    • DNS traffic - count of unique requests from IP
    • DNS traffic - increased percentage of queries
    • DNS traffic - possible homograph attack
    • DNS traffic - threshold for unique queries
    • DNS traffic - detection of DNSSEC error
    • DNS traffic - Tunneling detected
    • Resolver - Cloud communication failure
    • Resolver - Insufficient hardware resources
    • Resolver - Resolution service failure
    • Threats - count during intervals
    • Threats - event detection
    • Threats - newly blocked domain

Integrations

  • API Integration
  • Syslog Integration
    • Requirements
    • Log files
    • Examples
      • content.log
      • passivedns.log
      • whalebone.log
    • Limitations
  • Device name visibility via DNS lookup integration
    • How it works?
    • What is a PTR Record?
      • Common Uses of PTR Records
      • How the DNS Resolver Enriches Logs
      • Important Note
  • SNMP Monitoring
    • High Level Network Diagram
    • SNMP OID
      • Zabbix Integration
    • How to import the Whalebone Template
    • How to add the resolver in Zabbix Monitoring
    • How to add the Whalebone widget on Zabbix dashboard
    • How to add triggers on the Zabbix
    • How to configure the trigger actions
    • How to view the pre-defined Whalebone dashboard

Organization Settings

  • User Management
    • Role Definitions
    • Special Role Permissions
    • Management permissions
      • Alerts admin
      • API credentials
      • Blocking page editor
      • Cloud Resolvers Admin
      • DNS admin
      • Home Office Security admin
      • Identity protection admin
      • List editor
      • Reports admin
      • Security policy admin
      • Users admin
    • View permissions
      • Audit logs reader
      • Cloud Resolvers Read Only
      • List viewer
      • Read all traffic (content, DNS, threats)
      • Read only - all
      • Read only operations
      • Traffic Content
      • Traffic DNS
      • Traffic Threats
      • Users view
  • Organization Settings
    • Portal Access Policy
    • Password Policy
  • Multitenancy
    • Tenant administration
    • Roles
    • Inherited policies
    • Known limitations

Home Office Security

  • Home Office Security Overview
    • Why DNS-level protection matters
    • Key features
    • Supported operating systems
    • System requirements
    • Known limitations
    • Changelog
    • Glossary
  • Installation
    • Before you begin
    • Portal configuration
    • Unattended Installation (Windows 64-bit)
    • Uninstallation
    • GUI Installation (Windows 64-bit)
    • Manual Installation (Android / iOS)
    • Post-installation verification
  • Operation and Monitoring
    • Device states
    • Automatic resolver selection
    • Protection behavior
    • Monitoring
  • Troubleshooting
    • MSI exits early
    • “Unsupported architecture” error
    • Device not visible in the Admin Portal
    • Internal domain not recognized
    • Policy not updated
    • Internal domains cannot be resolved
    • The user can access domains that should be blocked (Windows)
    • The “Network has not Internet access” error on Android
    • Log and configuration locations (Windows)
    • Technical support (Windows)
    • Log and configuration locations (Android and iOS)

Identity protection

  • Identity Protection Overview
    • Domain settings
    • Notifications settings
    • More information

Single Sign-On (SSO)

  • Overview
  • SSO Settings
    • Admin Portal’s SSO URLs
    • Integration with Popular Identity Providers
      • Microsoft Active Directory Federation Services (ADFS)
  • Troubleshooting
    • 404 Page not Found
    • 404 Page not Found Even After 3 Hours
    • Missing Identity Attribute
    • Missing Roles Value Attribute
    • Low-Level Troubleshooting

Step-by-Step Video Guides

  • Deployment
    • On-premise resolver deployment
    • Cloud resolvers
  • Configuration
    • Basic configuration
    • Security policies
    • Blocking page configuration
    • Alerts
  • Analysis
    • Domain analysis
    • DNS traffic
    • Threats
    • Data Analysis
    • API
    • Domain resolution troubleshooting
    • Domain Tracing

About

  • License Disclaimers
    • the CRC64 variant with Jones coefficient
    • the Lightning.NET Library
Whalebone
  • Search

© Copyright 2026, Whalebone, s.r.o.

Built with Sphinx using a theme provided by Read the Docs.