Index of/

📖 Description

HaGeZi DNS Blocklists are lists of domains that block ads, trackers, telemetry, phishing, malware, scams, and other unwanted content across your whole network, before any of it reaches your devices. They work with every common DNS server, ad blocker, and content blocker.

This is the official, always-on mirror. Same lists as the main source, with every published format gathered in one place, so you're never left hanging if the main source hiccups.

The mirror runs on infrastructure operated by DNSBUNKER.org with HaGeZi's authorization. The lists and this README are pushed and maintained by HaGeZi.

This page is the short version. For the full per-list documentation, formats, FAQ, and glossary, see the detailed documentation.

Licensed under the GNU General Public License v3.0 (GPL-3.0). See the Disclaimer section below for the full redistribution and liability terms.

📑 Table of Contents

• Quick Setup
• Migrating from Another Mirror
• Supported Formats
• Blocklists Cheat Sheet
  • Main Tiers
  • Security Add-ons
  • Bypass and Rebind Protection
  • Content Filtering
  • Native Trackers
  • Referral Lists
• Direct Link Generator
• Blocklist Lookup
• DNS Resolver Services
  • DNSBUNKER.org
  • HaGeZi DNS
• Support
• Glossary
• Disclaimer

🚀 Quick Setup

Already have a working setup from a different source and just want to switch the download URL? Skip ahead to Migrating from Another Mirror instead, the steps in this section are for a brand new setup.

Before you start: these three steps assume you already run something that can subscribe to blocklists, a DNS server like Pi-hole, AdGuard Home, or TechnitiumDNS, or a content blocker like uBlock Origin or the AdGuard app. If you don't have one and don't want to set one up, skip straight to DNS Resolver Services, where these lists are already running for you.

Three steps, in this order:

1. Pick your format first. Check Supported Formats to see which one your DNS filter or firewall actually understands (Adblock, AdGuard, RPZ, and so on), and note its Extension pattern from that table. This decides both the top level folder you'll open in the file browser above and how the file names look inside it. Not sure which one your tool speaks? The table has a tip for that.
2. Pick your lists. Browse the Blocklists Cheat Sheet and note the file names of whatever you want, starting with a tier from Main Tiers, then adding Threat Intelligence Feeds from Security Add-ons, see the tip there for why this pairing matters at every tier. Layer on anything else you need from there. File names shown in the cheat sheet are for the Adblock format; adjust them to match your format's extension pattern from step 1.
3. Grab each link and subscribe to it, one list at a time. In the file browser, open the folder matching the format you picked in step 1. For each file from step 2 (renamed to match that format's pattern): click its copy icon, switch to your DNS filter or firewall, and add that single link as a new blocklist subscription. Then go back to the file browser and repeat for the next file. Each list needs its own separate subscription entry. Most tools won't accept several links pasted into a single field, so add them one by one unless yours explicitly supports bulk input. Quicker route for the copying part: the Direct Link Generator hands you every link at once, already named correctly for your format.

Worked example: the ⭐ Recommended default, Pro plus Threat Intelligence Feeds (Full), on a blocker using the Adblock format. Open the adblock/ folder, copy the link next to pro.txt, add it as a subscription, then do the same for tif.txt as a second, separate subscription. Adblock uses a plain *.txt pattern, so both file names match the cheat sheet unchanged. If your blocker can't handle TIF's full size, use tif.medium.txt or tif.mini.txt instead.

Keep them current. These lists change constantly. Most tools refresh subscribed lists on their own, but check that the option is enabled, and if yours doesn't support it, re-download the files from time to time. This mirror always serves the latest build.

🔄 Migrating from Another Mirror

Already using a different source for these blocklists? Switching over to this mirror is quick. Just replace the base part of your existing URL with the new base below, and keep the rest (the format folder and file name) exactly as it is.

New base URL for all of the above: https://hagezi-mirror.dnsbunker.org/

Here's a full example, so you can see it in action:

https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/adblock/pro.txt becomes https://hagezi-mirror.dnsbunker.org/adblock/pro.txt

Everything after the base URL, the adblock/pro.txt part in this case, stays the same. Just update your DNS filter or firewall config with the new base and you're good to go.

📇 Supported Formats

Pick whichever format actually talks to your DNS filter or firewall. The Example column shows what an entry for example.com actually looks like in each format, so you can tell them apart at a glance.

For the domain-based formats, the Syntax column also tells you how subdomains are handled. Wildcard formats match every subdomain of a listed domain automatically, so a single entry is usually enough. Explicit formats have no wildcard mechanism, so every subdomain that should be caught has to be spelled out as its own entry, which is why those files are much larger and still can't cover everything, see the note below the table.

📑 Blocklists Cheat Sheet

The lazy scroller's cheat sheet for every list in the collection: what it does, what to watch out for, who should grab it, and the actual file name.

The matrix below shows which commonly overlapping lists are already included in each Main Tier and in TIF. A half-filled circle means partial inclusion; its color shows the relative coverage within that row: orange = less, yellow = more, green = most. The same matrix is available as a text table in the detailed documentation.

Start with a tier from Main Tiers below to set your baseline, then layer on whatever you need from Security Add-ons, Bypass and Rebind Protection, Content Filtering, Native Trackers, or Referral Lists. Most lists across those five categories are separate, opt-in additions that no Main Tier includes. Three things work differently: Fake and Pop-Up Ads are already bundled into most tiers, and Native Tracker coverage is baked into every tier at a different strength, so the per-vendor files there fine-tune what you already have rather than adding it from scratch. The Already in Main Tiers column in those tables spells out the exact overlap. Grab whichever combo fits your setup and go make the internet a nicer place.

Want the full scoop on any individual list? Check out the detailed per-list documentation for all the details.

Main Tiers

These are the baseline lists. Pick exactly one as your foundation, then optionally layer other categories on top.

Security Add-ons

Optional lists that add specific security protections on top of whatever Main Tier you picked. Fake and Pop-Up Ads are already bundled into most Main Tiers by default (see the Already in Main Tiers column below). Everything else here, including every TIF variant, is a separate, opt-in addition that no Main Tier ships as a list.

Bypass and Rebind Protection

Optional lists that close specific loopholes: services people use to dodge DNS filtering, and attacks that abuse DNS to reach your local network. None of these are bundled into any Main Tier, all four are separate, opt-in additions. If you're building a kid-safe network, the DoH/VPN/Tor/Proxy Bypass (Full) list below is part of the recommended combination described in Content Filtering.

Content Filtering

Optional lists for blocking specific categories of content, commonly used for parental controls or workplace filtering rather than general security. None of these are bundled into any Main Tier. There are five lists here, shipped as seven files since Gambling comes in three sizes. Those three are alternatives, not building blocks, so pick one Gambling variant rather than combining them. Every list here is a separate, opt-in addition. The recommended combination for a kid-safe network is Gambling, Anti Piracy, Safesearch, Social Networks, and NSFW, together with DoH/VPN/Tor/Proxy Bypass (Full) from Bypass and Rebind Protection above, which stops a device from simply switching to its own encrypted DNS and walking around all of them.

Native Trackers

Native tracker lists cover everything used to monitor user activity built directly into devices, apps, and operating systems, which can occasionally limit functionality too. Unlike the other categories on this page, native tracker blocking isn't something you opt into separately, it's already baked into every Main Tier at a different strength, see the Already in Main Tiers column below for the exact breakdown.

The per-device files in the table are for fine-tuning that default coverage, not for adding tracker blocking from scratch. Use them to block (or, by leaving one out, effectively allow) tracking from one specific vendor rather than all of them at once, useful if you want stronger native-tracker coverage without moving all the way up to Ultimate. When combining these with your Main Tier, you might occasionally need to manually unblock a specific tracker if something breaks.

Referral Lists

Two opposite, optional lists for handling affiliate and referral tracking links, on top of whatever your Main Tier already does (see Main Tiers above: Light and Normal block none, Pro blocks a few, Pro++ and Ultimate block a few more). Neither list is bundled into any Main Tier. Use at most one of these two lists, they solve the same problem in opposite directions.

🔗 Direct Link Generator

Don't feel like clicking through folders and renaming files by hand? The Direct Link Generator puts your download links together for you.

Pick a source and a format, or just tell it which app or device you use and it sets the format for you. Then pick one Main Tier, tick whatever add-ons you want, and every matching link shows up at the bottom. There's a copy button per link and a Copy all links button for the whole set.

The useful part is that it knows what overlaps. Pick Pro and the Fake list greys out, because Pro already carries it. Tick an NRD band and DGA locks, because you want one or the other, never both. The two referral lists behave the same way, since which one makes sense depends on your tier. And the full TIF list in RPZ format comes as both of its files automatically, so you can't end up subscribed to half of it. Lists that are unusually large, or powerful enough to cause trouble if you enable them blindly, carry a small badge as well. You get a set that fits together, not just a pile of links.

The source starts on DNSBunker, this mirror, which is the freshest option. You can switch it to jsDelivr, GitHub, GitLab, or Codeberg if you'd rather pull from one of those, and the links change with it.

🔎 Blocklist Lookup

Wondering whether a specific domain or IP is blocked, and which list is doing it? Check it here: Blocklist Lookup

Paste in one entry or a whole batch, one per line and up to 50 per query, hit Search, and you get a card per entry listing every list that blocks it along with the exact rule. Domains and IPv4 addresses both work, so you can check something like ads.tracker.net and 1.1.1.1 in the same run. Wildcard patterns like *.example.com work too, listing every matching rule, and you can paste a full URL or bracketed notation (example[.]com) straight in. It reads the lists straight from this mirror, so the results always reflect the newest build.

It's subdomain-aware too. Look up region1.app-measurement.com and you'll see the match comes from ||app-measurement.com^, a wildcard on the parent domain, not an entry for that exact hostname.

It also follows CNAME chains, up to 8 hops. A domain that isn't on any list itself still gets flagged if it points at something that is, which is exactly how CNAME cloaking hides trackers behind a harmless looking first-party name. The result then shows the full chain, so you can see where the block actually comes from.

Three things it's especially good for:

• A site broke. Your query log gives you the domain, the Lookup tells you which list is responsible, so you know whether to allowlist it or move to a less aggressive tier from Main Tiers.
• Before switching tiers. Check a domain you depend on first. If it shows up under Pro++ but not under Pro, you know what you'd be signing up for.
• Before reporting. A report naming the domain, the list, and the rule is much faster to act on, see Support.

The NRD and DGA lists aren't searched by default. They're very large and including them slows the search down noticeably, so tick Include NRD and DGA lists only when you specifically want to know whether a domain is caught as a newly registered or algorithm-generated domain.

🏬 DNS Resolver Services

Don't want to run your own DNS server or config at all? Use one of these managed resolvers instead, free, non-commercial public resolvers for Europe that mix privacy and security with minimal restrictions. The full protection endpoints run the Pro and Threat Intelligence Feeds blocklists; the security-only endpoint further down runs Threat Intelligence Feeds alone, so ads and trackers stay untouched there. Handy for protecting your phone even when you're off your home Wi-Fi.

Which protocol? Use DoH (or DoH3, the faster variant) if your device or router supports encrypted DNS, that's most modern systems. DoT and QUIC are alternatives some tools prefer. Do53 is classic unencrypted DNS, use it only if nothing else works. On iPhone, iPad, or Mac, skip the manual setup entirely: the Apple Config column links a configuration profile that sets up the encrypted server with one tap.

🏬 DNSBUNKER.org

Full details: project page.

Full protection (ads, tracking, analytics, telemetry, phishing, malware, scam, cryptojacking, and other harmful domains)

Blocklist(s) in use: Pro and TIF

🏬 HaGeZi DNS

Full details: project page.

Full protection (ads, tracking, analytics, telemetry, phishing, malware, scam, cryptojacking, and other harmful domains)

Blocklist(s) in use: Pro and TIF

Security-only (phishing, malware, scam, cryptojacking, and other harmful domains)

Blocklist(s) in use: TIF

💫 Support

To get your report resolved quickly, include the exact domain, which list and tier you're using (for example Pro or Ultimate), and, for a false positive, what actually broke (a specific site, app, or feature) so it can be reproduced. If your tool keeps a query log, a quick look there confirms the exact domain responsible, and the Blocklist Lookup tells you which lists block it and with which rule.

🔤 Glossary

Short explanations of terms used on this page. For the full glossary with around 90 entries, see the detailed documentation.

Basics

Connection protocols

Formats

Listed in the same order as the Supported Formats table above.

Threats and list terms

⚠️ Disclaimer