1. A network security system comprising: a learning engine to record domain names from Domain Name System (DNS) requests within a network environment, wherein the learning engine records the domain names during a predetermined time frame; a counter to count a number of times a plurality of respective domain names have been used during the predetermined time frame; a filter module to filter the respective domain names based on a reputation source and the respective number of times the plurality of respective domain names have been used during the predetermined time frame to yield a filtered domain name subset, wherein the recorded domain names are based on the filtered domain name subset; and an enforcement engine to: intercept inline DNS requests; determine whether a domain name associated with one of the inline DNS requests corresponds with one of the recorded domain names; and perform a security action based on the determination.