Which checks does a web proxy with content control typically perform, and how does it help when a DNS answer points a user to a manipulated site?

It checks SSL certificates, applies black- and whitelists, controls downloaded content, blocks unwanted content such as executables, and detects malicious content and manipulated URLs. If a manipulated DNS server sends the browser to a fake look-alike server, the proxy can recognise and block the manipulated web content.

* Even when DNS points to a fake server, the proxy's checks on certificate, URL and content can stop the page. *

A typical scenario: the DNS server has been manipulated so that the name of site a resolves to a look-alike server a′, and server b serves manipulated content. Without a proxy, the browser would load both. With one, the request goes to the proxy, which checks the certificate, the URL against its lists and the content against its patterns, and refuses what fails.

The firewall rule that makes this work: only the proxy may talk HTTP(S) to the internet (webproxy -> internet: allow http(s)), and everything else between internet and company is denied.

Go deeper:

• DNS spoofing — Wikipedia — how a manipulated DNS answer sends users to a fake server.
• Internet filter (content-control software) — Wikipedia — category lists, blacklists and their side effects.