Package: dns-blackhole
Most of code comes from here:http://git.mauras.ch/Various/powerdns_recursor_ads_blockingCheck it for history.This script helps you create a blackhole zone for your DNS server,
using some well known ads/tracking/malware lists.As long as your DNS server allows to include a file containing one
domain per line with its config syntax it should work.Right now known to work and tested:UnboundPowerDNS recursorDnsmasqGenerating an agregated host file is also possible.FeaturesNot bound to a specific DNS server, generates a file format of your
choiceSupports 3 different list formatHost fileEasylistDisconnectLets you whitelist/blacklist domainsYAML configuration fileInstallationThe script requiresPyYAMLandrequestsmodules.pipinstall[--upgrade]dns-blackholeUnboundRequires unbound >=1.6, using the default zone file with unbound1.5will certainly make it eat all your ram and swap before
getting killed.Addinclude: "/etc/unbound/blackhole.zone"right after yourserver:block.Use the followingzone_datain yourdns-blackhole.yml(default):zone_data:'local-zone:"{domain}"always_nxdomain'{domain}wil be replaced by the blackholed domainsPowerDNS RecursorAddforward-zones-file=/etc/pdns/blackhole.zonein your recursor
configuration.Use the followingzone_datain yourdns-blackhole.yml:zone_data:'{domain}='{domain}wil be replaced by the blackholed domainsDnsmasqAddconf-dir=/etc/dnsmasq.din your dnsmasq config and point yourzone_fileoption to/etc/dnsmasq.d/blackhole.confUse the followingzone_datain yourdns-blackhole.yml:zone_data:'server=/{domain}/'{domain}wil be replaced by the blackholed domainsHost fileUse the followingzone_datain yourdns-blackhole.yml:zone_data:'127.0.0.1{domain}'Once you’re happy with your configuration Just rundns-blackhole.The default lists indns-blackhole.ymlwill generate a zone
containing ~698000 entries.ConfigurationAs the configuration file is in YAML, you can use YAML anchorsdns-blackhole:general:cache:/var/cache/dns-blackholelog:/var/log/dns-blackhole/dns-blackhole.logwhitelist:/etc/dns-blackhole/whitelistblacklist:/etc/dns-blackhole/blacklistblackhole_lists:hosts:-http://someonewhocares.org/hosts/hosts-https://hosts-file.net/download/hosts.txt-http://winhelp2002.mvps.org/hosts.txt-http://www.malwaredomainlist.com/hostslist/hosts.txt-https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts;showintro=0easylist:&bh_easy-https://easylist.to/easylist/easylist.txt-https://raw.githubusercontent.com/paulgb/BarbBlock/master/BarbBlock.txtdisconnect:&bh_disconnecturl:https://services.disconnect.me/disconnect-plaintext.jsoncategories:# Advertising, Analytics, Disconnect, Social-Advertising-Analyticsconfig:zone_file:/etc/unbound/blackhole.zone# {domain} will be replaced by the blackholed domain, do not change it herezone_data:'local-zone:"{domain}"always_nxdomain'blackhole_lists:hosts:-http://winhelp2002.mvps.org/hosts.txteasylist:*bh_easydisconnect:*bh_disconnectIn this example you would keepeasylistanddisconnectlists,
but would remove all host file lists except mvps.FAQWhat’s the advantage of having the DNS server returning NX instead of 127.0.0.1Host lists are usually returning127.0.0.1or0.0.0.0.Depending of the system and/or browser you use, you can end up having
timeout/slowness issues as it retries to connect several times before
considering the remote resource down.Having your DNS server return NXDOMAIN - Non existant domain - on the
other side makes your client behave faster as there’s nothing to retry
when the domain doesn’t exist.Why using forward-zones-file option instead of auth-zones in PowerDNS recursor?Syntax of theauth-zonesis like this:auth-zones=dom1=<zone>,dom2=<zone>,dom3=<zone>,etcWhile this may work for 5000 black holed domains, for almost 700 000
the speed of generation is so slow that it takes several tens of
minutes to complete. Even worse, with such a list, pdns-recursor is
not even able to start and will crash.By using theforward-zones-filepdns-recursor takes around 5 more
seconds to process the zone file.Which DNS server is the best?It’s really a matter of preferences and what you have available. Use the
one you’re the most comfortable with.TODOCache is not implemented yetLog is not implemented yet