Local network device connection control

An apparatus in a local computer network comprising one or more processor devices, the one or more processor devices configured to:

• receive a domain name system (DNS) query from a client computing device of the local computer network, wherein the DNS query is associated with a fully qualified domain name (FQDN);
• decrypt the DNS query for mapping the FQDN associated with the DNS query to a corresponding internet protocol (IP) address in response to the DNS query being encrypted;
• request reputation information related to the FQDN from a local database, wherein the reputation information is indicative of whether the FQDN should be blocked;
• and
• in response to determining that the matching FQDN is not found in the local database, the one or more processor devices are further configured to:
• allow the DNS query to proceed from the local computer network to a cloud DNS resolver of a network service provider;
• log and map the IP address and a MAC address of the client computing device to the local database in response to receiving a response from the cloud DNS resolver;
• request the reputation information related to the FQDN from a cloud FQDN server;
• and
• update the local database with the reputation information related to the FQDN and block further queries to the FQDN in response to receiving the reputation information indicating that the FQDN should be blocked from the cloud FQDN server.

A non-transitory computer-readable medium comprising stored program code, the program code comprised of computer-executable instructions that, when executed by a processor, cause one or more processor devices to:

• receive a domain name system (DNS) query from a client computing device of the local computer network, wherein the DNS query is associated with a fully qualified domain name (FQDN);
• decrypt the DNS query for mapping the FQDN associated with the DNS query to a corresponding internet protocol (IP) address in response to the DNS query being encrypted;
• request reputation information related to the FQDN from a local database, wherein the reputation information is indicative of whether the FQDN should be blocked;
• in response to determining that a matching FQDN is not found in the local database, the one or more processor devices are further configured to:
• allow the DNS query to proceed from the local computer network to a cloud DNS resolver of a network service provider;
• log and map the IP address and a MAC address of the client computing device to the local database in response to receiving a response from the cloud DNS resolver;
• request the reputation information related to the FQDN from a cloud FQDN server;
• and
• update the local database with the reputation information related to the FQDN and block further queries to the FQDN in response to receiving the reputation information indicating that the FQDN should be blocked from the cloud FQDN server.