Abstract: A domain name system (DNS) resolver includes a processor and a non-transitory computer-readable media storing instructions that, when executed by the processor, causes the processor to perform operations including receiving, from a client device, a request for an internet protocol (IP) address associated with a domain name, determining the IP address associated with the domain name, sending first data defining the IP address associated with the domain name to the client device, and sending second data defining the IP address associated with the domain name to a firewall device, the second data including an identification of the client device.