DNS Client Query Filtering (CQF) is a DNS-layer security feature integrated within EfficientIP's SOLIDserver DDI platform that enforces application access control at the DNS resolution level. Rather than filtering based solely on destination domains, CQF filters DNS queries using both source client information and requested domain, enabling client-specific security policies. The filtering process relies on three core components: - A list of client identifiers and associated tags - A list of domains to analyze - An operation to perform: allow, deny, or apply a countermeasure Client identification supports multiple methods including IP address, DNS Client Subnet (ECS) field, subnet-level grouping, or composite keys combining CPE identification and MAC address — making it applicable to enterprise LANs, ISP networks, and telecom environments. Domain lists are managed as standard RPZ (Response Policy Zone) zones, configurable via GUI or API through the SOLIDserver platform, and can be sourced from external threat intelligence providers. Policies and lists are distributed to DNS Guardian servers via standard DNS replication mechanisms. CQF uses a tagging system to associate metadata (traffic category, client type, etc.) with identifiers, enabling complex policy definitions using join/match operators. This reduces the number of required list entries and supports fine-grained microsegmentation. Key use cases include: internet access restriction, IoT device security, SaaS application access control, Shadow IT detection, and parental control for telecom operators. The feature is designed to support zero trust architectures by enforcing least-privilege DNS resolution at the earliest point in network traffic flow.