Domain name system identification and attribution

An apparatus comprising:

• a network interface unit configured to enable network communications;
• and
• a processor configured to:
• receive, from a client device, a Domain Name System (DNS) request at a DNS resolver, wherein the DNS request is a query for a network address of one or more resources associated with a requested domain name;
• determine that the client device should be blocked from accessing the resources associated with the requested domain name;
• extract, from the DNS request, information associated with the client device;
• construct a falsified network address based on the requested domain name, wherein the falsified network address is encoded with the client information;
• and
• send to the client device, a DNS response that associates the requested domain name with the falsified network address.

One or more non-transitory computer readable storage media of a server in communication with clients, the computer readable storage media being encoded with software comprising computer executable instructions, and when the software is executed, operable to:

• receive, from a client device, a Domain Name System (DNS) request at a DNS resolver, wherein the DNS request is a query for a network address of one or more resources associated with a requested domain name;
• determine that the client device should be blocked from accessing the resources associated with the requested domain name;
• extract, from the DNS request, information associated with the client device;
• construct a falsified network address based on the requested domain name, wherein the falsified network address is encoded with the client information;
• and
• send to the client device, a DNS response that associates the requested domain name with the falsified network address.