I ask this question because for example for email security an email can be blocked if the source IP and/or source domain (DNS FQDN) are in a blacklist. From what I read the F5 Ip intelligence provides only a feed for bad IP addresses but there are attackers that use DYNAMIC DNS: DATA EXFILTRATION can change the domain related ip addresses very often and this could a usefull feature if not present at the moment.

Yea! I’m using this codeshare with great sucess! [image] DNS Interception: Protecting the Client Articles F5 Technical Articles big-ip-dns security devops irules application-delivery ip-intelligence swg gtm dns [u]Introduction[/u] Everything starts with a DNS request. So why not use it to protect the client? With the recent addition of Secure Web Gateway Services to the F5 line up of modules in TMOS 11.5, it provided the ability to access a URL... this code validates the query FQDN with URL Feed and also can validate the response with IPI.

Aha , so with the SWG URL database I can create data groups and then use them in an iRule including and irule HTTP requests(when HTTP_REQUEST) or for the DNS requests (when DNS_REQUEST ) :slight_smile: create ltm data-group internal dns_request_url_categories_dg type string modify ltm data-group internal dns_request_url_categories_dg records add {“Adult_Content”} F5 needs to better document this solution as it seems to not be well known. Also maybe with the SIDEBAND function I can reference also a free URL/FQDN database, using HTTP(S) as the communication protocol, in the iRule and use it in checking the DNS FQDN domains or URLs. Again thanks for the idea. SIDEBAND HTTP Super SIDEBAND Requestor (Client) Handles Redirects, Cookies, Chunked...

Is there F5 ip intelligence based on domain/FQDN (domain intelligence)?

Forums Technical Forums

Bernabe_Crena May 10, 2021, 3:12pm 4

Yea! I’m using this codeshare with great sucess!

this code validates the query FQDN with URL Feed and also can validate the response with IPI.

Topic		Replies	Views
Dynamic FQDN Node DNS Resolution based on URI with Route Domains and Caching iRule Community CodeShare big-ip , irules , data-group	7	4581	November 21, 2025
What are the available cloud databases for F5 DNS/GTM response policy zones (RPZ)? Technical Forums irules , devops , security , dns , gtm , ip-intelligence	3	295	August 29, 2025
all possible Domain names that F5 may need to communicate to Technical Forums announcement	1	292	June 19, 2025
FQDN Node with Route Domains Technical Forums application-delivery , ltm	7	2700	July 21, 2025
The Power of IP Intelligence (IPI) F5 Technical Articles security , f5-sirt	5	7736	July 23, 2024

Is there F5 ip intelligence based on domain/FQDN (domain intelligence)?

Related topics