DNS sinkholing is the best solution to meet these requirements. By redirecting malicious DNS requests (such as those from compromised endpoints attempting to contact command and control (C2) infrastructure) to a "sinkhole" server, the security engineer can prevent communication between the malware and the attacker's infrastructure. Additionally, DNS sinkholing allows for tracking and logging of the requests that the malware attempts to make, while also preventing the malware from downloading additional payloads by blocking these connections.