Browser extension
When DNS PATROL blocks a domain, the browser on its own only shows its default “site can’t be reached” page. It shows the same page for a typo in the address or a server outage. The resolver does attach the reason for the block to its answer as an Extended DNS Error (RFC 8914), but browsers ignore it.
The DNS PATROL extension for Chrome and Edge replaces that page with its own page showing the reason the resolver gave. For a blocked domain it tells the user the site is blocked and advises them to contact their administrator. For other errors, such as a failed DNSSEC validation, it says the site isn’t working.
The extension resolves nothing itself and makes no network connections. It passes the domain to DnsPatrol.NativeHost.exe, a helper the application installs as a native messaging host. The helper queries the local DNS proxy on 127.0.0.1 and returns the response code and Extended DNS Error from the answer. The extension therefore works only on a computer with the Windows application; without it, the extension shows nothing.
Technical details
The Technical details drop-down holds information for administrators and IT support:
| Item | Description |
|---|---|
| Reference | Four-character reference code identifying the event in the resolver’s logs |
| Response | DNS response code |
| EDE | Extended DNS Error code |
| Meaning | Meaning of the EDE code |
| Rule tag | Tag of the rule that caused the block |
| Triggered on | Domain the rule matched |
| Raw EXTRA-TEXT | Original text the resolver attached to the answer |
| Queried domain | Domain that was queried |
| URL | Address of the page being opened |
| Time | Time of the event |
| Extension | Extension version |
Items for which the resolver supplied no value are not shown.
The Try again button reloads the page, the Copy details button copies a plain-text summary to the clipboard. When reporting a problem, it is enough to paste the text with the reference code instead of a screenshot.
Toolbar popup
The extension’s toolbar popup lists the last 20 errors and can check any domain on demand. The list stays on the computer and holds domain names only, never the addresses of the pages being opened.
Deployment
The extension is installed from the Chrome Web Store. The application installer force-installs it in Chrome and Edge through the ExtensionInstallForcelist policy, so users cannot remove it. Uninstalling the application removes the policy entry again. If the organization manages ExtensionInstallForcelist through group policy (GPO), the next GPO refresh overwrites the installer’s entry. In that case, install the application with the EXTENSION_POLICY=0 parameter and add the extension to the GPO directly:
hjfhghkohajmhhillcmbpmkbnleaidgo;https://clients2.google.com/service/update2/crx