A method at a router apparatus of a local computer network comprising a processor device, comprising: receiving , by a DNS resolver device of the router apparatus, a domain name system, DNS, query from a client computing device of the local computer network, wherein the DNS query is associated with a fully qualified domain name, FQDN; in response to the DNS query being encrypted, decrypting the DNS query by the DNS resolver device for mapping the FQDN associated with the DNS query to a corresponding internet protocol, IP, address; requesting , by the DNS resolver device, reputation information related to the FQDN from an agent device of the router apparatus, wherein the reputation information is indicative of whether the FQDN should be blocked; and in response to the agent device determining that a matching FQDN is not found in a local database: allowing , by the DNS resolver device, the DNS query to proceed from the DNS resolver device to a cloud DNS resolver of a network service provider; in response to receiving, at the agent device, a response from the cloud DNS resolver, logging and mapping the IP address and a medium access control, MAC, address of the client computing device to the local database by the agent device; requesting, by the agent device, the reputation information related to the FQDN from a cloud FQDN server; and in response to receiving the reputation information indicating that the FQDN should be blocked from the cloud FQDN server, updating the local database with the reputation information related to the FQDN and blocking further queries to the FQDN. receiving , by a DNS resolver device of the router apparatus, a domain name system, DNS, query from a client computing device of the local computer network, wherein the DNS query is associated with a fully qualified domain name, FQDN; in response to the DNS query being encrypted, decrypting the DNS query by the DNS resolver device for mapping the FQDN associated with the DNS query to a corresponding internet protocol, IP, address; requesting , by the DNS resolver device, reputation information related to the FQDN from an agent device of the router apparatus, wherein the reputation information is indicative of whether the FQDN should be blocked; and in response to the agent device determining that a matching FQDN is not found in a local database: allowing , by the DNS resolver device, the DNS query to proceed from the DNS resolver device to a cloud DNS resolver of a network service provider; in response to receiving, at the agent device, a response from the cloud DNS resolver, logging and mapping the IP address and a medium access control, MAC, address of the client computing device to the local database by the agent device; requesting, by the agent device, the reputation information related to the FQDN from a cloud FQDN server; and in response to receiving the reputation information indicating that the FQDN should be blocked from the cloud FQDN server, updating the local database with the reputation information related to the FQDN and blocking further queries to the FQDN. allowing , by the DNS resolver device, the DNS query to proceed from the DNS resolver device to a cloud DNS resolver of a network service provider; in response to receiving, at the agent device, a response from the cloud DNS resolver, logging and mapping the IP address and a medium access control, MAC, address of the client computing device to the local database by the agent device; requesting, by the agent device, the reputation information related to the FQDN from a cloud FQDN server; and in response to receiving the reputation information indicating that the FQDN should be blocked from the cloud FQDN server, updating the local database with the reputation information related to the FQDN and blocking further queries to the FQDN. <EOS>