HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
hagezi
dns-blocklists
Text2024–2026
hagezi / dns-blocklists

dns-blocklists

DNS-Blocklists: For a better internet - keep the internet clean!

Security & PrivacyObservabilityNetworkingCommunication & Social
Explore on GitHubRead Hacker News discussions
14Distinct people
19Mentions
0Explicit recommenders
28.7KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

DNS-Blocklists: For a better internet - keep the internet clean!

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year19 dated mentions

Observed mentions: 2024-02-07 02:23:53 UTC to 2026-10-07 09:41:56 UTC.

0369122024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments20242025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 4 mentions; 1 submissions, 3 comments20252026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 12 mentions; 1 submissions, 11 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC303
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC413
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC12111

What Hacker News says

19 sources
BLKNSLVR·Oct 7, 2026
I'm currently (very slowly, in the small gaps between 'life') setting up a site the host the lists and also explains them and their usage. Since it's not ready, it'll be best if I point you to the sources I've aggregated from: https://firebog.net/ https://github.com/hagezi/dns-blocklists https://github.com/StevenBlack/hosts https://github.com/jerryn70/GoodbyeAds Link to my in-progress list file hosting: https://lists.uninvitedactivity.com/DNS/ 00_Tiers directory: I've aggregated the lists into four tiers: Base, Recommended, Aggressive, and Paranoid. And I've got two sets of these, one that includes Newly Registered Domains (Full directory), and one that doesn't include NRDs (NoNRD directory, because NRDs are ... heavy: Paranoid list with NRDs: 9.1 million records, without NRDs: 3.7 million records). 11_Allow directory: A bunch of allow li
Read the rest
sts sourced from: https://discourse.pi-hole.net/t/commonly-whitelisted-domains.... I also use this list for an Allow list: https://github.com/anudeepND/whitelist 21_SpecificTopics directory: Aggregation of lists under the topic that matches the file name. Fake News list needs to be updated as it contains a _way_ overbroad list that I need to remove from the aggregation.
In ESP32-C3 Adblock
tengwar2·Jul 8, 2026
Firstly, I'm not intending any slight on you personally! In fact this might be more of an issue for you interacting with the site than for people just reading an article. There are multiple versions of the list. The authoritative site appears to be https://github.com/hagezi/dns-blocklists, and making a fairly random choice, I used the "medium" version of the "Threat intelligence feed", and specifically the one marked "Link" for AdBlock. That took me to https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adb..., and manualmeida.dev does appear in that list. The software I'm using is Little Snitch on a Mac, but since the entry is in the list, that's not the problem.
In NoiseLang: Where N = 5 is a Dirac delta
xoa·Jun 7, 2026
>Adding to DNS block list immediately. Just making a note here for anyone else with the same thought: I went to ping the domains listed ITT, and nothing went through. I'm running OPNsense and amongst other things using some of the hagezi DNS block lists [0]. It looks like brdtnet.com, bright-sdk.com and various subdomains were already in there, which is a nice sanity check. That said, also worth noting that an Unbound or other resolver based DNS block list can prevent resolution but doesn't preventing connecting to the underlying IP, it's not the same thing as actually invoking your firewall itself. For that I think you need to stick the lists into something that will resolve them regularly and then actually Firewall that off. So for OPNsense you can setup an alias using the URL Table (plain text) or URL Table in JSON depending on format,
Read the rest
or manage it externally directly if desired via external. Then the source will be updated and aliases will all be resolved on operator defined schedules, and can in turn be fed into regular firewall rules. Don't forget these can turn into massive lists, so make sure your internal resource limits (so for OPNsense that'd be Firewall Maximum Table Entries) are set sufficiently high and the hardware can handle it. Other systems may handle it differently, just it's important to double check what is actually happening including if something malicious tries to be sneakier. And ultimately for these sorts of untrustable embedded devices that lack owner control, it's probably a lot better and more sustainable, if more effort upfront, to isolate them into their own vlan/subnet and then whitelist instead of blacklist. So they can only access what you decide they need to and nothing else, vs access everything except what is disallowed. Still, blacklisting bad actors as a final layer for everything may still be useful. ---- 0: https://github.com/hagezi/dns-blocklists
In The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy
exiguus·Apr 3, 2026
If I understand this correctly, LinkedIn fingerprints your browser. And browsergate, now, shows how harmful this can be, combined with private data (like your job, full-name and ID) been sold to 3rd-party. Companies are in it to make money, and if something is free, you're the product. If you think about, to protect yourself: The EFF privacy badger browser add-on [1] try to block fingerprinting. Also, browser fingerprints are a common tracking pattern nowadays. You can test [2] your browser and please start protect your self: E.g. use add-ons like U-Block and Privacy Badger to block tracking and/or use different browser and devices for different use cases. DNS-blocking with block-list like hegazi [3] is IMO the best option, but also a bit more involved, when you host you own DNS forwarder(s). For example AdGuard Home [4] helps you with ho
Read the rest
sting your own DNS infrastructure. It's also possible to add block-lists to dnsmasq or unbound and run them on you notebook as forwarders. [1] https://privacybadger.org/ [2] https://coveryourtracks.eff.org/ [3] https://github.com/hagezi/dns-blocklists [4] https://adguard.com/en/adguard-home/overview.html
In LinkedIn is searching your browser extensions
drnick1·Jan 2, 2026
> Realistically though there's enough fingerprinting in browsers to track you regardless of your public IP and whether it's shared between every device in the house or if you dole out a routable ipv4 to every device. Yes, browser fingerprinting is a big issue, but it can be mitigated. The first thing everyone should do is to use a network-wide DNS blacklist against all known trackers (e.g. https://github.com/hagezi/dns-blocklists) and run uBlock Origin in the browser. You can go further and restrict third party scripts in uBlock, or even all scripts. This will break at lot of websites, but it is a surefire way to prevent fingerprinting. Then of course there is Tor.
In IPv6 just turned 30 and still hasn't taken over the world
raspasov·Oct 4, 2025
macOS is a UNIX (a certified one even!) so it really doesn’t care what or how you’re running a program. You can put anything anywhere manually on disk and run it. If some of those languages require any “global singletons”, that’s probably their fault even though I doubt that’s the case. “It’s not exactly the same as Linux” is not a valid complaint for me, in case that’s the root cause of concern. Yes it’s not, and never tried to be. If “near full” isolation is the goal, Docker-style containers are always an option. Then it’s basically the same as Linux. Also, Python is notoriously finicky with the slight differences between versions. I mostly use the JVM nowadays and that’s a breeze to run any version on the same macOS using a tool like jenv (which is available for Linux, macOS, etc). I believe Python has some of those tools also to make
Read the rest
isolated “environments”. PS In terms of block ads: I literally just “solved this”. I used to run the likes of AdGuard which works decently but I never felt too good about it because it’s a bit opaque about how it actually works. Here’s how you can get your own DNS-based adblock on Mac for free, in just a few minutes: 1. Install dnsmasq https://en.wikipedia.org/wiki/Dnsmasq 2. Get a dnsmasq-compatible .conf blocklist from https://github.com/hagezi/dns-blocklists Sample dnsmasq config: listen-address=127.0.0.1 conf-file=/path/to/chosen_blocklist.conf #google dns or pick your own server=8.8.8.8 server=8.8.4.4 3. In your Network settings, set the DNS to 127.0.0.1 This will pass all DNS requests through dnsmasq first 4. Enjoy system-wide (including native apps!) ad-free experience
In Rescuer at Fatal Tesla Cybertruck Crash Says Car Doors Wouldn't Open
pogue·Aug 19, 2025
You definitely want to be following yokoffing's NextDNS Configuration Guide [1] to set it up. You basically only want to be using one of the Hagezi blocklists [2] and a possibly a few other options based on your preferences. I have it running on every device in my household and it works absolutely fine. I keep it on Hagezi Pro++, and that requires me to go through and whitelist some sites I use. That can be annoying, so in that case Hagezi Light or Normal should work just fine to block ads/trackers and not break things you have to go in and manually fix. OTOH, Control D offers free DNS [3] that includes using the Hagezi blocklists and other lists, but it's just a set and forget type setup as you can't look at log files to see if it's blocking stuff you don't want or anything like that. Scroll down to "3rd Party Filters" to see their offer
Read the rest
ings. [1] https://github.com/yokoffing/NextDNS-Config [2] https://github.com/hagezi/dns-blocklists [3] https://controld.com/free-dns
In Show HN: NextDNS Adds "Bypass Age Verification"

Showing the 15 most recent of 19 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.