dns-blocklists

:zap: DNS Blocklists, let's make the internet a nicer place!

Built with :heartbeat: for a safer, cleaner internet. It always looks impossible until someone just goes ahead and does it.

What this is: a set of DNS blocklists that block ads, trackers, telemetry, phishing, malware, scams, and other unwanted domains network-wide. They work for any region and with every common DNS server, ad blocker, and content blocker.

Like this project? If it's helped you out, drop a :star: (top right) and join the stargazers club! Every star genuinely helps.

New here? Start with Multi PRO plus the Threat Intelligence Feeds list, pick the format that matches your tool, and follow the quick setup guide. Unsure which version fits you? See which list version should I use. In a hurry? The Direct Link Generator hands you both download links in one go.

[!NOTE] About the cleaning tools below. The five Multi versions are named after cleaning tools, and you'll see that wording throughout this page: Light is the hand brush, Normal the broom, Pro the big broom, Pro++ the sweeper, and Ultimate the ultimate sweeper. The bigger the tool, the more thoroughly it cleans, and the more likely it is to sweep up something you wanted to keep.

---

:bookmark_tabs: Table of Contents

1. Overview: Which format do I need?
2. Multi LIGHT, hand brush: basic protection
3. Multi NORMAL, broom: all-round protection
4. Multi PRO, big broom: extended protection (recommended): Full - Mini
5. Multi PRO++, sweeper: advanced protection (more aggressive): Full - Mini
6. Multi ULTIMATE, ultimate sweeper: maximum protection (most aggressive): Full - Mini
7. Fake, block scams, traps, and fake sites!
8. Pop-Up Ads, stop annoying and malicious pop-ups!
9. Threat Intelligence Feeds, a serious security boost (recommended): Full - Medium - Mini - IPs
10. Newly Registered Domains (NRD/DGA), a favorite tool of threat actors for launching attacks!
11. Dynamic DNS (DynDNS), guard against dynamic DNS abuse!
12. Badware Hoster, guard against malicious hosting services!
13. Most Abused TLDs, block known shady top-level domains!
14. DNS Rebind Protection, stop attackers from pointing domains at your local network!
15. DoH/VPN/Tor/Proxy Bypass, stop people from sneaking around your DNS: Full - DoH only - DoH IPs
16. Safesearch not supported, block search engines that skip Safesearch!
17. URL Shortener, block link shorteners!
18. Anti Piracy, block piracy sites!
19. Gambling, block gambling content: Full - Medium - Mini
20. Social Networks, block access to social networks!
21. NSFW, block adult content!
22. Native Tracker, block built-in trackers from devices, apps, and OSes!
23. Direct Link Generator, build your download links with a few clicks!
24. Blocklist Lookup, check any domain or IP against every list!
25. Blocklists Cheat Sheet, quick reference table for every list at a glance
26. Recommendation: Which list version should I actually use?
27. Online DNS Services: AdGuard DNS - ControlD - HaGeZi DNS - DNSBUNKER.org - Public RDNS - RobinGroppe.de - RethinkDNS - DNSwarden - OpenBLD.net
28. About: Repository - Referral Domains - Support
29. FAQ, frequently asked questions, including the quick setup guide and the glossary
30. Discussions
31. Update Interval/Official Mirrors
32. Sources
33. Disclaimer
34. Contact

---

:books: Multi, cleans up the internet and protects your privacy!

This is an all-in-one DNS blocklist that comes in several versions (light, normal, pro, pro++, and ultimate). You can run it standalone, and it works for any region. It blocks ads, trackers, metrics, telemetry, fake sites, phishing, malware, scams, cryptojacking, and other junk. It's built on various source blocklists, but that doesn't mean it's just a pile of lists glued together. Everything here has been optimized and extended so it actually cleans up the internet across the board.

Curious about the sources? Check out: Which sources are used for the lists and how are they compiled?

Blocklist versions at a glance:

For a full inclusion matrix that also covers the standalone lists, see the Cheat Sheet.

Main lists at a glance:

List	Blocking type	Risk of breakage	Entries	Size-optimizedversion
:green_book:Light	Relaxed	Minimal	88382	-
:blue_book:Normal	Relaxed/Balanced	Low	206744	Light: 88382
:ledger:Pro	Balanced	Low to moderate	225344	Mini: 99478
:orange_book:Pro++	Balanced/Aggressive	Moderate	243787	Mini: 100472
:closed_book:Ultimate	Aggressive	High	266259	Mini: 111258
:closed_lock_with_key:TIF	Threats only	Low	1441295	Medium: 363724Mini: 188782

The first five build on each other, so pick exactly one of them. TIF works differently: it's an add-on covering malware, phishing, and other live threats, and it's worth running alongside any tier. The size-optimized versions are alternatives to their full list, never something you add on top. Entry counts change with every build.

[!TIP] :information_desk_person: Not sure which version fits you? Check this out.

Which format do I need?

Most lists below are published in the same five standard formats. Pick the row that matches your tool. Within these five, the blocked domains are the same, only the way they're written down changes.

Format	Use it with
Adblock	Pi-hole, AdGuard, AdGuard Home, eBlocker, uBlock Origin, Brave (aggressive mode only), AdBlock-Fast, AdNauseam, Little Snitch Mini (smaller lists only)
DNSMasq	DNSMasq (v2.86 or newer), Diversion (v5 or newer)
Wildcard Asterisk	Blocky (v0.23 or newer), Nebulo, NetDuma, OPNsense, YogaDNS
Wildcard Domains	DNSCloak, DNSCrypt, FRITZ!Box (FRITZ!OS v8.40 or newer), TechnitiumDNS, adblock-lean, PersonalDNSfilter, InviZible Pro
RPZ	Bind, Knot, PowerDNS, Unbound, and other software supporting Response Policy Zones

[!IMPORTANT] :link: Don't want to pick a format or copy links by hand? Use the Direct Link Generator. Select the app or device you use and it sets the format for you, then tick the lists you want and copy every download link in one go: hagezi-mirror.dnsbunker.org/dlg.html

A handful of lists don't follow this pattern, because their content or their exclusion rules can't be expressed the same way in every format. Those are Most Abused TLDs (its own set of format variants), DNS Rebind Protection (AdGuard only), NRD/DGA (Adblock and plain domains only), and the IP lists for TIF and DoH. Each of those sections spells out what's available.

[!NOTE] The legacy Subdomains and Hosts formats live in a separate repository. For the complete format-to-tool breakdown, see the FAQ.

---

:green_book: Multi LIGHT, basic protection

Hand brush edition. Cleans up the internet and protects your privacy without going overboard. Blocks ads, trackers, metrics, telemetry, and some badware. Basically a size-optimized version of Multi NORMAL, built only from domains that appear on Top 1M/10M lists (Umbrella, Cloudflare, Tranco, Chrome, BuiltWith, Majestic, DomCop, NetAPI).

[!NOTE] This version shouldn't cause any real restrictions. Great if your ad blocker chokes on big lists, or anywhere even Normal's low risk is too much.

[!IMPORTANT] Doesn't block error trackers like Bugsnag, Crashlytics, Firebase, Instabug, Sentry, and similar app crash reporters. Those only get blocked starting with the Pro version.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
88382	Link	Link	Link	Link	Link

---

:blue_book: Multi NORMAL, all-round protection

Broom edition. Cleans up the internet and protects your privacy. Blocks ads, trackers, metrics, telemetry, phishing, malware, scams, fakes, cryptojacking, and other junk.

[!NOTE] This one mostly won't cause restrictions either. Good pick if you don't have an admin handy to unblock anything.

[!IMPORTANT] Doesn't block error trackers like Bugsnag, Crashlytics, Firebase, Instabug, Sentry, and similar app crash reporters. Those only get blocked starting with the Pro version.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
206744	Link	Link	Link	Link	Link

---

:ledger: Multi PRO, extended protection (recommended)

Big broom edition. Cleans up the internet and protects your privacy. Blocks ads, trackers, metrics, telemetry, phishing, malware, scams, fakes, cryptojacking, and other junk.

[!NOTE] Restrictions here are rare. Works best if you've got an admin nearby who can unblock something if needed. This is my personal go-to recommendation for solid ad blocking with good privacy without much hassle.

[!WARNING] Referral domains (affiliate and tracking links): Most referral domains are still allowed here, but a handful get blocked anyway, mainly ones that double as regular trackers or are commonly tied to scam and spam links. Details: Referral domains

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
225344	Link	Link	Link	Link	Link

:ledger: Multi PRO mini (best for browser/mobile ad blockers)

A size-optimized version made for DNS or browser blockers, like devices with limited RAM. This only contains domains from the full Pro list that appear on Top 1M/10M lists (Umbrella, Cloudflare, Tranco, Chrome, BuiltWith, Majestic, DomCop, NetAPI).

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
99478	Link	Link	Link	Link	Link

---

:orange_book: Multi PRO++, advanced protection (more aggressive)

Sweeper edition. This one cleans up the internet aggressively and protects your privacy hard. Blocks ads, trackers, metrics, telemetry, phishing, malware, scams, fakes, cryptojacking, and other junk.

[!WARNING] This is the more aggressive sibling of Multi PRO. It might block a few legit domains by mistake, so it's best for experienced users. Ideally have an admin ready to unblock things that break.

[!WARNING] Referral domains (affiliate and tracking links): More referral domains get blocked than in Pro, specifically the ones that aren't used exclusively for link tracking. The bulk of the category still stays allowed. Details: Referral domains

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
243787	Link	Link	Link	Link	Link

:orange_book: Multi PRO++ mini

Built the same way as Pro mini, but from the full Pro++ list: only its domains that appear on the Top 1M/10M lists make the cut. For DNS or browser blockers on limited hardware.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
100472	Link	Link	Link	Link	Link

---

:closed_book: Multi ULTIMATE, maximum protection (most aggressive)

Ultimate sweeper edition. Strictly cleans up the internet and locks down your privacy. Blocks ads, trackers, metrics, telemetry, phishing, malware, scams, fakes, cryptojacking, and other junk.

[!CAUTION] This is a stricter version of Multi PRO++. It contains domains that can limit app or website functionality, including some popular trackers that will cause hiccups. Only use this if you know what you're doing, and make sure someone can unblock things when needed.

[!WARNING] Referral domains (affiliate and tracking links): Same as Pro++: referral domains that aren't used exclusively for link tracking are blocked, the rest of the category stays allowed. Details: Referral domains

Facebook: Ultimate blocks some META trackers, which limits Facebook and Facebook Messenger app functionality. It also blocks WhatsApp's graph trackers, which can mess with avatar creation, the in-app help center, and video effects. Other than that, WhatsApp works fine. If you use META apps alongside Ultimate, unblock these domains as needed: META Tracker

Windows/Xbox: Some Microsoft trackers are blocked too, which can affect things like Windows Spotlight and Xbox Live Achievements Activity History. Check here for details on which domains to unblock for which feature: Microsoft Tracker.

Location and IP trackers: Certain trackers that websites use to pin down your IP or location get blocked. Great for privacy, but it might trigger wrong regional settings, extra CAPTCHAs, or reduced site functionality here and there. These trackers are usually used for hidden analytics and ad targeting.

Anything else: More known quirks are listed here.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
266259	Link	Link	Link	Link	Link

:closed_book: Multi ULTIMATE mini

Built the same way as Pro mini, but from the full Ultimate list: only its domains that appear on the Top 1M/10M lists make the cut. For DNS or browser blockers on limited hardware.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
111258	Link	Link	Link	Link	Link

---

:trollface: Fake, blocks scams, traps, and fake sites!

This blocklist targets fake stores, fake streaming sites, rip-offs, subscription traps, and similar scams.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
18763	Link	Link	Link	Link	Link

---

:tada: Pop-Up Ads, stops annoying and malicious pop-ups!

Targets pop-up ads that range from annoying to outright malicious.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
79817	Link	Link	Link	Link	Link

---

:closed_lock_with_key: Threat Intelligence Feeds, a serious security boost (recommended)

This blocklist targets malware, cryptojacking, scams, spam, and phishing. It blocks domains known for spreading malware, running phishing attacks, and hosting command-and-control servers.

[!WARNING] This list is huge and can eat up a lot of memory depending on your ad blocker. If that's an issue, grab the medium or mini version instead. It's too big for the iOS AdGuard mobile app, and AdGuard Home needs at least 2 GB RAM. The RPZ version had to be split into two files because of its size, you need both.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ(split)
1441295	Link	Link	Link	Link	:one: Link:two: Link

:closed_lock_with_key: Threat Intelligence Feeds, medium version (best for browser/mobile ad blockers)

A medium-sized version of the TIF list, built for ad blockers that struggle with the full-size version. Includes only the most important feeds.

[!WARNING] Too big for the iOS AdGuard mobile app. AdGuard Home needs at least 1 GB RAM.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
363724	Link	Link	Link	Link	Link

:closed_lock_with_key: Threat Intelligence Feeds, mini version

A size-optimized version of the TIF Medium list, for ad blockers that even struggle with that one.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
188782	Link	Link	Link	Link	Link

:closed_lock_with_key: Threat Intelligence Feeds, IPs

There's also an IPv4 version of this list, in plain IP format for firewalls and AdGuard Home format, which extends the regular TIF list.

[!TIP] If you use the IP list in AdGuard Home, it'll block any domain that resolves to a blocked IP. To stop domains from slipping through via IPv6, turn off IPv6 resolution in AdGuard Home: Settings > DNS settings > DNS server configuration > Disable resolving of IPv6 addresses

---

:new: Newly Registered Domains (NRD/DGA)

Newly registered domains (NRDs) are a favorite tool for threat actors running phishing, malware, and command-and-control operations, since these domains are easy to throw away and help dodge detection.

There are two variants:

• NRDs: every newly registered domain, no filtering.
• Entropy NRDs/DGAs: only newly registered domains with high entropy, meaning they were likely generated by a Domain Generation Algorithm (DGA). These have a random-looking structure and are commonly used by malware for resilient command-and-control channels.

[!WARNING] These lists are big and resource-heavy. They can spike memory usage and include false positives, since some legit domains are new too. Use with care and whitelist important services if needed.

[!CAUTION] Use these at your own risk. NRD lists come as-is, with no guarantees, no support, and no formal process for fixing false positives.

[!IMPORTANT] The base data comes from Stamus Labs. Stamus Labs doesn't promise daily updates, so the data can sometimes lag by a few days.

Current status of the data:

• Stamus Labs: :green_circle: - Sun, 08 Nov 2026 04:35:39 UTC / 12174456 domains

:new: NRDs: all newly registered domains, unfiltered

Timeperiod	Entries	FormatAdblock	FormatDomains
7 days ago to yesterday	2706800	Link	Link
14 days ago to 8 days ago	2531486	Link	Link
21 days ago to 15 days ago	3092745	Link	Link
28 days ago to 22 days ago	2965208	Link	Link
35 days ago to 29 days ago	3049813	Link	Link

[!NOTE] The five files are non-overlapping bands, so stack them for wider coverage: nrd7 plus nrd14-8 covers the last 14 days, add nrd21-15 for 21 days, and so on.

[!TIP] Besides the formats here, NRDs are also available elsewhere:

• Wildcard (Asterisk): Cebeerre/dnsblocklists

:capital_abcd: Entropy NRDs/DGAs: only newly registered, high-entropy domains generated by DGAs

[!NOTE] These domains are already part of the full NRD list, just filtered down.

Timeperiod	Entries	FormatAdblock	FormatDomains
Past 7 days	611935	Link	Link
Past 14 days	1228921	Link	Link
Past 30 days	2916820	Link	Link

---

:lock_with_ink_pen: Dynamic DNS (DynDNS), guards against dynamic DNS abuse!

Blocks dynamic DNS services that get abused for phishing campaigns and other shady activity.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
1519	Link	Link	Link	Link	Link

---

:computer: Badware Hoster, guards against malicious hosting services!

Blocks known hosting providers that repeatedly host badware through user-uploaded content.

[!IMPORTANT] This list blocks the root domains of hosting providers that keep showing up in threat feeds because of malicious subdomains. That means legit sites hosted there will get blocked too, so think it through before using this one.

If you use this list, you're on your own for unblocking any subdomains you actually need.

[!CAUTION] Blocking whole hosting providers is overkill for most setups and can break legit services. In high-security environments though, that trade-off might make sense.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ	ControlD
1110	Link	Link	Link	Link	Link	Link

---

:crystal_ball: Most Abused TLDs, blocks known shady top-level domains!

Blocks the most abused top-level domains, combining data from Cloudflare Radar, Netcraft, and SpamHaus.

[!WARNING] This list blocks entire top-level domains (like *.top, *.shop, *.gdn) that have a bad reputation overall. Yes, that means some legit sites get caught in the crossfire too, but it's really effective against spam, scams, phishing, malware, and other garbage. Know what you're signing up for.

Only well-known, reputable domains that show up on the supported top lists (Umbrella, Cloudflare, Tranco, Chrome, BuiltWith, Majestic, DomCop, NetAPI) or are essential for popular apps get considered for exclusion. Illegal domains, including piracy sites, stay blocked no matter what. Anything that doesn't clearly qualify gets reviewed case by case, and if there's no good reason to unblock it, it stays blocked. If you need access to something specific, add it to your personal allowlist.

This selective approach exists because AdGuard and uBlock Origin have technical limits on rule length when using denyallow/domain modifiers. Trying to exclude every legit domain would eventually break important rules, so exclusions have to stay limited and carefully picked.

This list doesn't follow the usual five-format pattern, since the exclusion rules work differently from tool to tool.

Format	Link	Notes
AdGuard	Link	For AdGuard and AdGuard Home
uBlock Origin	Link	For uBlock Origin and Adblock Plus
Adblock	Link	For Pi-hole and TechnitiumDNS. Spam TLDs with no exclusions
Adblock(Aggressive)+ Allowlist	LinkLink	For Pi-hole and TechnitiumDNS. Use both together
WildcardDomains+ Allowlist	LinkLink	For DNSCrypt. Use both together
RPZ	Link	Spam TLDs with no exclusions
RPZ(Aggressive)	Link	All spam TLDs, matching the AdGuard and uBlock Origin versions
ControlD	Link	Importable ControlD folder

---

:shield: DNS Rebind Protection, stops attackers from pointing domains at your local network!

DNS Rebind Protection stops attackers from messing with DNS responses to make a domain point to a private or local IP address. This blocks malicious scripts from using DNS rebinding attacks to reach your internal network.

[!IMPORTANT] This only works with AdGuard/AdGuard Home, and it's also selectable in AdGuard DNS. Other DNS blockers may already have their own rebind protection built in.

Since rebind protection blocks anything resolving to a local IP, your internal hostnames might get caught too. In AdGuard, whitelist your local domains, something like: @@||fritz.box^

Format	Link
AdGuard	Link

---

:outbox_tray: DoH/VPN/Tor/Proxy Bypass, stop people from sneaking around your DNS!

Blocks common ways to bypass your DNS setup.

[!NOTE] To make sure your DNS server is actually the one being used, you'll need to redirect or block standard DNS traffic (TCP/UDP 53) and also block DNS over TLS/QUIC (TCP/UDP 853) outbound.

This comes as three lists. The first two are alternatives, pick one; the third is an IP-level companion to the DoH-only list, not to the complete edition:

:outbox_tray: Complete edition: encrypted DNS servers, VPN, Tor, proxies

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
16363	Link	Link	Link	Link	Link

:outbox_tray: Encrypted DNS servers only

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
3571	Link	Link	Link	Link	Link

:outbox_tray: Encrypted DNS server IPs

There's also an IPv4 version in plain IP format for firewalls, and an AdGuard Home format.

[!TIP] If you use the IP list in AdGuard Home, it'll block any domain that resolves to a blocked IP. To stop domains from slipping through via IPv6, turn off IPv6 resolution in AdGuard Home: Settings > DNS settings > DNS server configuration > Disable resolving of IPv6 addresses

---

:mag: Safesearch not supported, blocks search engines that skip Safesearch!

Blocks search engines that don't support Safesearch.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
200	Link	Link	Link	Link	Link

---

:link: URL Shortener, blocks link shorteners!

Blocks every known URL/link shortener out there.

[!WARNING] Not really meant for everyday setups. Blocking all URL shorteners makes the most sense in high-security environments, since shorteners can hide where a link actually leads and help enable attacks. In lower-risk settings, keeping an eye on things or just being careful usually does the job.

If you use this list, you're on your own for unblocking any domains you actually need.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
9754	Link	Link	Link	Link	Link

---

:skull: Anti Piracy, blocks piracy sites!

Blocks sites and services mainly used for illegally distributing copyrighted content.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
60395	Link	Link	Link	Link	Link

---

:slot_machine: Gambling, blocks gambling content!

Blocks gambling-related sites.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
634928	Link	Link	Link	Link	Link

:slot_machine: Gambling, medium version

A medium-sized version for ad blockers that have trouble with the full gambling list.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
139766	Link	Link	Link	Link	Link

:slot_machine: Gambling, mini version

A size-optimized version of the Gambling Medium list. Only contains domains that appear on Top 1M/10M lists (Umbrella, Cloudflare, Tranco, Chrome, BuiltWith, Majestic, DomCop, NetAPI).

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
71688	Link	Link	Link	Link	Link

---

:speech_balloon: Social Networks, blocks access to social networks!

Blocks social networks like Facebook, Instagram, TikTok, X (formerly Twitter), Snapchat, and others.

[!NOTE] This list won't block messaging apps like WhatsApp or streaming platforms like Twitch. It's strictly aimed at classic social networking sites.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
8159	Link	Link	Link	Link	Link

---

:underage: NSFW, blocks adult content!

Blocks adult content.

Entries	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
78410	Link	Link	Link	Link	Link

---

:calling: Native Tracker, blocks built-in trackers from devices, apps, and OSes!

Blocks the native trackers baked into devices, services, and operating systems that quietly track what you do.

[!IMPORTANT] Native tracker lists cover everything used to monitor user activity, which can occasionally limit functionality too. They're integrated across all the standard tiers (Light, Normal, Pro, Pro++, Ultimate) at four increasing blocking levels:

• Light and Normal: the baseline. Only native trackers that won't break functionality, for a smooth experience.
• Pro: blocks more than the baseline, while still staying out of your way.
• Pro++ (aggressive): blocks nearly all of them, which might cause some restrictions or limit certain features.
• Ultimate: the most thorough option, blocking all native trackers for max privacy.

Pick whichever tier matches how aggressive you want to be about native tracker blocking.

When combining native tracker lists with the standard lists, you might need to manually unblock a specific tracker here or there.

Device/Service	Adblock	DNSMasq	WildcardAsterisk	WildcardDomains	RPZ
Amazon (Devices, Shopping, Video)	Link	Link	Link	Link	Link
Apple (iOS, macOS, tvOS)	Link	Link	Link	Link	Link
Huawei (Devices)	Link	Link	Link	Link	Link
Microsoft (Windows, Office, MSN)	Link	Link	Link	Link	Link
Samsung	Link	Link	Link	Link	Link
TikTok (Fingerprinting)	Link	Link	Link	Link	Link
TikTok (Fingerprinting) Aggressive	Link	Link	Link	Link	Link
LG webOS	Link	Link	Link	Link	Link
Roku	Link	Link	Link	Link	Link
Vivo	Link	Link	Link	Link	Link
OPPO/Realme	Link	Link	Link	Link	Link
Xiaomi	Link	Link	Link	Link	Link

---

:link: Direct Link Generator, build your download links with a few clicks!

Rather not click your way through every list section on this page? The Direct Link Generator puts the links together for you: hagezi-mirror.dnsbunker.org/dlg.html

Pick a source and a format, or just select the app or device you use and it sets the format for you. Then pick one Multi tier, tick the add-ons you want, and every matching link shows up at the bottom of the page. Copy them one by one, or grab the whole set with Copy all links. The source starts on the build mirror and can be switched to jsDelivr, GitHub, GitLab, or Codeberg, which also makes it an easy way to move an existing setup from one source to another.

It's more than a typing shortcut, because it knows how the lists relate to each other: anything your chosen tier already covers gets greyed out, partial overlaps are spelled out instead of hidden, NRD and DGA lock each other out, and picking the full TIF list in RPZ format hands you both of its files so you can't end up subscribed to half of it. Lists that are unusually large, or powerful enough to cause trouble if you enable them blindly, carry a small badge as well.

[!NOTE] It covers the five standard formats only, so the legacy Subdomains and Hosts formats aren't in there, and NRD, DGA, and the referral lists only show up in Adblock and Wildcard (Domains) format. Most Abused TLDs, DNS Rebind Protection, the IP lists for TIF and DoH, and the ControlD folders follow their own naming scheme and are left out entirely, so use the link tables on this page for those. More detail in the FAQ.

---

:mag_right: Blocklist Lookup, check any domain or IP against every list!

Not sure whether a domain is blocked, or which list is responsible for it? The Blocklist Lookup answers both: hagezi-mirror.dnsbunker.org/listseek.php

Paste in one entry or a whole batch, one per line and up to 50 per query, hit Search, and you get a card per entry listing every list that blocks it along with the exact rule. Domains and IPv4 addresses both work, so you can check something like ads.tracker.net and 1.1.1.1 in the same run. Wildcard patterns like *.example.com work too, listing every matching rule, and you can paste a full URL or bracketed notation (example[.]com) straight in. It reads the published lists straight from the build mirror, so the results always reflect the newest build.

It's subdomain-aware too: look up region1.app-measurement.com and you'll see the match comes from ||app-measurement.com^, a wildcard on the parent domain, not an entry for that exact hostname. It also follows CNAME chains, up to 8 hops, so a domain that isn't on any list itself still gets flagged if it points at something that is, and the result shows you the full chain.

Handy for hunting down a false positive, comparing what happens to a domain across tiers before you switch, or checking whether something is covered at all before you report it. The NRD and DGA lists aren't searched by default, they're very large and slow the search down noticeably, so switch them on only when you need them.

[!NOTE] The Lookup reads the published lists, not your own setup, and it doesn't judge whether a domain is harmful. Your local allowlist, extra lists from other projects, or a copy that hasn't refreshed yet can all make your network behave differently. More detail in the FAQ.

---

:bulb: Recommendation

For network-wide DNS blocking, I'd recommend AdGuard Home, Pi-hole, TechnitiumDNS, Blocky (if you're comfortable with advanced setups), adblock-lean (for OpenWrt), or eBlocker.

DNS blockers do a great job protecting your privacy by cutting off trackers, metrics, and telemetry. They can also block most ads, malware, scams, and fake sites, but they can't catch everything since some of that stuff doesn't work through DNS.

That's why I also recommend pairing this with a browser content blocker like AdGuard, uBlock Origin, or Ghostery.

Check out Yokoffing's Recommended Filters for uBlock Origin for good content blocker filter lists.

[!TIP] :information_desk_person: Still not sure which version to pick?

---

:department_store: Online DNS Services

Don't run your own DNS server at home, or want extra protection for your phone when it's off your home network? These DNS services have you covered.

[!TIP] Which lists are available on which DNS services?

:department_store: AdGuardDNS, limited free / unlimited trial / paid

On AdGuardDNS you can use:

• Normal, Pro, Pro++, Ultimate
• Threat Intelligence Feeds (TIF), Most Abused TLDs, Badware Hoster, DynDNS, DNS Rebind Protection, URL Shortener
• DoH/VPN/Tor/Proxy Bypass
• Gambling
• Anti Piracy
• Native Tracker (Apple, OPPO & Realme, Samsung, Vivo, Windows/Office, Xiaomi)
• NSFW (Parental Control > Block adult websites)
• Allowlist Referral

:department_store: ControlD, free / paid

On ControlD you can use Light, Normal, Pro, Pro++, Ultimate, and TIF.

Free:

Blocklists	DNS-over-HTTPS	DNS-over-TLS/QUIC	Legacy DNS	Apple
Light	https://freedns.controld.com/x-hagezi-light	x-hagezi-light.freedns.controld.com	76.76.2.3776.76.10.372606:1a40::372606:1a40:1::37	Link
Normal	https://freedns.controld.com/x-hagezi-normal	x-hagezi-normal.freedns.controld.com	76.76.2.4076.76.10.402606:1a40::402606:1a40:1::40	Link
Pro	https://freedns.controld.com/x-hagezi-pro	x-hagezi-pro.freedns.controld.com	76.76.2.4176.76.10.412606:1a40::412606:1a40:1::41	Link
Pro Plus	https://freedns.controld.com/x-hagezi-proplus	x-hagezi-proplus.freedns.controld.com	76.76.2.4276.76.10.422606:1a40::422606:1a40:1::42	Link
Ultimate	https://freedns.controld.com/x-hagezi-ultimate	x-hagezi-ultimate.freedns.controld.com	76.76.2.4576.76.10.452606:1a40::452606:1a40:1::45	Link
TIF	https://freedns.controld.com/x-hagezi-tif	x-hagezi-tif.freedns.controld.com	76.76.2.4676.76.10.462606:1a40::462606:1a40:1::46	Link

Paid:

Check out Yokoffing's ControlD Config Guide for good ControlD settings.

Automation:

controld-hagezi-sync: automatically syncs HaGeZi folder blocklists to ControlD profiles via API. Supports TOML config, dry-run mode, multi-profile mappings, and daily GitHub Actions syncs.

:department_store: HaGeZi DNS (EU: Germany/Finland, balanced blocking), free

HaGeZi DNS runs free, non-commercial public resolvers for Europe, mixing privacy and security with minimal restrictions using the Multi Pro and Threat Intelligence Feed lists.

More details in the project repository.

**Blocks ads, trackers, analytics, metrics, telemetry, phishing, malware, scams, fakes, cryptojackin