1. A network security system comprising: a learning engine to record domain names from Domain Name System (DNS) requests within a network environment; and an enforcement engine to: intercept inline DNS requests; determine whether a domain name associated with one of the inline DNS requests corresponds with one of the recorded domain names; and perform a security action based on the determination.