1. A system for detection and confinement of network malicious activities originating from a local host on a local network to a remote host outside of said local network, comprising: a local domain name system (DNS) server connected to said local network, configured to: receive from said local host a request for an outbound connection to said remote host, complete a DNS lookup to obtain an IP address of said remote host, and generate a conformity indication when said request for said outbound connection refers to a legitimate connection; a DNS policy repository configured to enable select requests from the local host to access specified remote resources without the DNS lookup; a DNS gatekeeper to generate a connection authorization indication based on said conformity indication; and a local enforcement unit connected between said local network and the remote host configured to block-establishment of said outbound connection by default, until it receives said connection authorization indication.