diff --git a/rama-dns/src/deny_all.rs b/rama-dns/src/deny_all.rs
new file mode 100644
index 00000000..f6d93a90
--- /dev/null
+++ b/rama-dns/src/deny_all.rs
@@ -0,0 +1,35 @@
+use crate::DnsResolver;
+use rama_net::address::Domain;
+use rama_utils::macros::error::static_str_error;
+use std::net::{Ipv4Addr, Ipv6Addr};
+
+#[derive(Debug, Clone, Default)]
+#[non_exhaustive]
+/// a [`DnsResolver`] implementation which
+/// denies all incoming DNS requests with a [`DnsDeniedError`].
+pub struct DenyAllDns;
+
+impl DenyAllDns {
+    #[inline]
+    /// Create a new [`Default`] [`DenyAllDns`].
+    pub fn new() -> Self {
+        Self::default()
+    }
+}
+
+static_str_error! {
+    #[doc = "Dns denied"]
+    pub struct DnsDeniedError;
+}
+
+impl DnsResolver for DenyAllDns {
+    type Error = DnsDeniedError;
+
+    async fn ipv4_lookup(&self, _domain: Domain) -> Result<Vec<Ipv4Addr>, Self::Error> {
+        Err(DnsDeniedError)
+    }
+
+    async fn ipv6_lookup(&self, _domain: Domain) -> Result<Vec<Ipv6Addr>, Self::Error> {
+        Err(DnsDeniedError)
+    }
+}
diff --git a/rama-dns/src/lib.rs b/rama-dns/src/lib.rs
index 76d43c98..d358c098 100644
--- a/rama-dns/src/lib.rs
+++ b/rama-dns/src/lib.rs
@@ -125,3 +125,7 @@ pub use hickory::HickoryDns;
 mod in_memory;
 #[doc(inline)]
 pub use in_memory::{DnsOverwrite, DomainNotMappedErr, InMemoryDns};
+
+mod deny_all;
+#[doc(inline)]
+pub use deny_all::{DenyAllDns, DnsDeniedError};