Singapore announces national DNS protection against known malicious sites

On October 13, Singapore announced plans for a national protective domain name service to block access to known phishing and malware sites.

An announcement is not a full rollout, and an unblocked website is not necessarily safe.

Where would the connection be stopped?

Before opening a website, a browser looks up the internet address associated with its name. Protective DNS checks that lookup and can block a destination already identified as malicious. It adds a defensive layer before a fake login page loads. CSA’s National Cybersecurity Command Centre is to operate the service, presented as national protection that complements personal security settings and organisations’ defences.

When would the plan become a service?

CSA’s release describes a service it will operate, without giving an exact date for full deployment. The body of The Straits Times’ October 13 report says rollout is expected in 2027. A short summary on that page sounds as though it has already launched, but the schedule in the full article must take precedence. There is consequently no basis to claim that every user’s traffic is already protected today. The share of internet traffic covered will also matter when judging effectiveness.

What if a legitimate site is blocked?

The official release identifies the Online Criminal Harms Act, or OCHA, as the legal basis and notes safeguards on exercising its powers. Independent reporting describes assessment and validation before blocking, plus reconsideration and appeal processes for affected individuals and organisations. Fast blocking and avoiding false positives need to be managed together. This concerns known malicious domains; it is not an announcement that all content will be automatically judged or every scam eliminated.

Why do blocked requests differ from prevented harm?

A security specialist interviewed independently cautions that the number of blocked DNS requests is not the number of attacks actually prevented. New scam sites may pass through before they are identified. Effectiveness depends on timely information and traffic coverage, while users still need to assess addresses and requests to log in or pay. Follow-up CSA guidance on deployment, coverage and false-block handling will make it possible to compare the plan with its actual results.

Primary sources and independent checks

Primary announcement: October 13 plan, operator, known malicious domains and legal basis: Cyber Security Agency of Singapore

Independent full report: expected 2027 rollout, safeguards and external expert limits; body over summary: The Straits Times: Kenny Chee

Read in other languages

한국어 · English · Español · 日本語 · Tiếng Việt