A computer implemented method for using aggregated DNS information originating from a plurality of computers to detect anomalous DNS name resolutions, the method comprising the steps of: Receiving, by a server DNS security component running on a server computer (105, 105A,,105N), multiple transmissions of DNS information from a plurality of computers (103, 103A, 103B, 103N), each transmission of DNS information comprising information concerning a specific instance of a resolution of a specific DNS name; Aggregating, by the server DNS security component running on the server computer, received multiple transmissions of DNS information from the plurality of computers; Comparing, by the server DNS security component running on the server computer, DNS information received from a specific computer concerning a specific DNS name to aggregated DNS information received from multiple computers concerning the same DNS name; determining, by the server DNS security component running on the server computer, whether the DNS information received from the specific computer concerning the specific DNS name is anomalous, responsive to comparing the DNS information received from the specific computer concerning the specific DNS name to the aggregated DNS information received from multiple computers concerning the same DNS name; and receiving by the server DNS security component running on the server computer, from a DNS security component running on a client computer, gleaned DNS information concerning each identified resolution of a DNS name by at least one specific computer, wherein the DNS security component running on the client computer identifies attempts to resolve DNS names by the at least one specific computer and gleans the DNS information concerning identified attempts to resolve DNS names by the at least one specific computer, wherein gleaning further comprises checking DNS settings local to the client computer, and gleaning DNS information concerning at least one local resolution of at least one DNS name. Receiving, by a server DNS security component running on a server computer (105, 105A,,105N), multiple transmissions of DNS information from a plurality of computers (103, 103A, 103B, 103N), each transmission of DNS information comprising information concerning a specific instance of a resolution of a specific DNS name; Aggregating, by the server DNS security component running on the server computer, received multiple transmissions of DNS information from the plurality of computers; Comparing, by the server DNS security component running on the server computer, DNS information received from a specific computer concerning a specific DNS name to aggregated DNS information received from multiple computers concerning the same DNS name; determining, by the server DNS security component running on the server computer, whether the DNS information received from the specific computer concerning the specific DNS name is anomalous, responsive to comparing the DNS information received from the specific computer concerning the specific DNS name to the aggregated DNS information received from multiple computers concerning the same DNS name; and receiving by the server DNS security component running on the server computer, from a DNS security component running on a client computer, gleaned DNS information concerning each identified resolution of a DNS name by at least one specific computer, wherein the DNS security component running on the client computer identifies attempts to resolve DNS names by the at least one specific computer and gleans the DNS information concerning identified attempts to resolve DNS names by the at least one specific computer, wherein gleaning further comprises checking DNS settings local to the client computer, and gleaning DNS information concerning at least one local resolution of at least one DNS name.