dns-blocklists

Warning

Our public encrypted DNS servers were shut down on November 2, 2026. Read more about this on our blog This means our .mobileconfig files have stopped working and that repository has been archived.

This repository contains the Ansible playbook that we use to generate DNS based blocking files for VPN server (also known as VPN relay) based DNS blocking.

We aim to update these lists every Monday through Thursday. You can view the latest update by selecting the commits to this repository.

After updating the lists, it will take about an hour for all our servers to pick up the updated lists. However every VPN server has a 24 hour cache timeout.

Lists updated at 07:00 will be made available at the latest 09:00 on the same day, but may not be consumed and applied until 24 hours later.

Pull requests / Issues / Updating block lists

We prefer to not block individual custom URLs or add block lists without them being fully validated and verified first.

Please consider pointing us toward a reputable block list prior to making a Github Issue.

If we close your issue or reject your request, it is most likely down to us not having a way of verifying that the block list is trustworthy.

Custom DNS entries for use with our VPN service

All combinations of DNS content blockers can be found in the COMBINATIONS.md file.

Lists

The following lists are what we import to our service. You can find these defined in inventory/group_vars for the server type you wish to view.

• relay: VPN servers (relays)

Advertising

We currently use these advertising blocklists with our service:

• oisd-small: https://small.oisd.nl/rpz
• frellwits-swedish-hosts-file: https://raw.githubusercontent.com/lassekongo83/Frellwits-filter-lists/master/Frellwits-Swedish-Hosts-File.txt
• AdguardDNS: https://v.firebog.net/hosts/AdguardDNS.txt
• hagezi-popupads-onlydomains: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/wildcard/popupads.txt
• mullvad-ads-blocklist: custom file
• adguard-filters-mobile: https://adguardteam.github.io/AdguardFilters/MobileFilter/sections/adservers.txt

Trackers

We currently use these tracker blocklists with our service:

• firebog-easylist-privacy: https://v.firebog.net/hosts/Easyprivacy.txt
• hagezi-tracker-amazon: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/wildcard/native.amazon.txt
• hagezi-tracker-apple: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/wildcard/native.apple.txt
• hagezi-tracker-huawei: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/wildcard/native.huawei.txt
• hagezi-tracker-windows: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/wildcard/native.winoffice.txt
• hagezi-tracker-tiktok-aggressive: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/wildcard/native.tiktok.extended.txt
• hagezi-tracker-webos: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/wildcard/native.lgwebos.txt
• hagezi-tracker-vivo: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/wildcard/native.vivo.txt
• hagezi-tracker-oppo: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/wildcard/native.oppo-realme.txt
• hagezi-tracker-xiaomi: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/wildcard/native.xiaomi.txt
• mullvad-tracker-blocklist: custom file

Malware

We currently use these malware blocklists with our service:

• mullvad-malware-blocklist: custom file
• urlhaus: https://urlhaus.abuse.ch/downloads/hostfile
• hagezi-threat-intelligence-mini: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/tif.mini.txt

Adult content

We currently use this Adult content blocklist for our service:

• oisd-nsfw: https://nsfw.oisd.nl/rpz
• mullvad-adult-blocklist: custom file

Gambling

We currently use these gambling blocklists with our service:

• hagezi-gambling-onlydomains: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/wildcard/gambling-onlydomains.txt
• hagezi-gambling: https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/wildcard/gambling.txt

Social media

We generate our Social Media block lists from scripts located in scripts/

You can find the generated file in files/social

Why is list "X" not included?

If you find a block list is excluded it is because we have gone through these validation steps:

• The blocklist is an amalgamation of other blocklists.
• The blocklist is no longer maintained.
• The blocklist blocks things we do not believe should be blocked (like our own domains).

We periodically make exceptions to the included URLs for the following reasons:

• The upstream lists are broken and include malformed URLs causing the generation to fail.
• The upstream lists block our domains.
• You can view exceptions in inventory/group_vars/all.yml under the name of dns_blocklists_exclude, these are split per-blocklist.

Building

Information for building these blocklists has been moved to BUILDING.md.