BoundaryDNS blocks malicious domains using the public encrypted DNS resolver. No signup, tenant ID, or traffic routing required.