What DNS does — and does not do — against phishing
The name layer is good at catching some traps and useless against others. Telling the two apart is what stops you from trusting any single protection too much.
Phishing does not only use fake domains
A good share of phishing pages sit on real addresses. The official site was compromised, a legitimate service was fooled, or the attacker registered a name almost identical to the original. In those cases the address resolves correctly, the certificate is valid, and the name layer has nothing to block.
There is also the scam that uses no fake page at all: a link sent in a message that leads to a real site with a false payment request. The address is right, the padlock is in place, and the deception happens entirely in how you read it. No name filter protects against that.
What an anti-phishing list can see
What the list catches is the pattern of the name: newly registered domains, names that closely imitate well-known ones, addresses that already appeared in known campaigns. Because the block happens during the query, the connection to the phishing server is never even opened.
What stays out are the cases where the address is legitimate. A list that is updated late also lets fresh campaigns through, and some campaigns swap names several times precisely to get away. That is why the list works as one of the layers, not as the only one.
What to look at when the list is not enough
Read the address, not the design. The page can carry the same colours, the same logo and the same layout as the original service; what cannot be identical is the domain. A name with one character swapped for another that looks almost the same is the most common sign of a trap.
If the address arrived by message, type it yourself instead of following the link. If the page asks for data the real service would never request by message, stop. And remember that the padlock only means the connection is encrypted: there are valid certificates for hijacked domains and for fake pages on brand-new addresses.