Table des matières

( 🇨🇵 Cette page est disponible en Français: Listes de blocage DNS )

DNS Block List

DNS filtering is an easy way to block a vast majority of advertising, tracking and malware sites with a minimum of effort. This is quick to setup and easy to revert.

Frankly, this is the kind of thing I would install on all friends and family computers and smartphones. This significantly reduces system "rotting" (advertising, spyware, malware, tracking…)

Advantages of DNS filtering:

Drawbacks:

You do not need to worry: The setup is easy to reverse.

As an example, a typical CNN page is 20 Mb. With this DNS blocklist alone, it drops to 10 Mb. This is a 50% gain. Not only the page will load faster, but you will save on your data and phone bills, even if you use a browser which is not capable of filtering.

List

URL to use: https://sebsauvage.net/hosts/hosts

What does this list blocks ?

Sources

This list is an aggregation of the following sources:

The blocklist is available in several formats:

URL Notes
https://sebsauvage.net/hosts/hosts
[RECOMMENDED] 		hosts format (0.0.0.0 hostname)
Suited for Android and computers
This hosts file can be used as is in Windows, Linux, MaOSX and in personalDNSFilterr and DNS66 on Android.
https://sebsauvage.net/hosts/hosts-adguard AdGuard/uBlock-Origin format (||hostname^)
Suited for Android and computers
This list can be used in AdGuard (on Android) and uBlock-Origin.
https://sebsauvage.net/hosts/raw Raw format (hostname) (just the domains, no headers)

Whitelist

These blocking lists make occasional mistakes. I have put some domains on a whitelist. These domains will never be blocked.

Click to display

Click to display

DomaineReason
sebsauvage.netMy own domain so that list updates are not blocked.
proxad.netProfessionnal french hosting company (branch of Free.fr ISP)
commentcamarche.netComputer tutorials website
www.commentcamarche.netComputer tutorials website
mail.gandi.netMail server of one of the biggest french professional hosting companies
c.orange.frLinked to the webmail of Orange, one of the biggest french ISP
iapref.orange.frLinked to the webmail of Orange, one of the biggest french ISP
iapref.wanadoo.frLinked to the webmail of Orange, one of the biggest french ISP
metric.gstatic.comSome sub-domains are used for DoT (DNS-over-TLS)
ssl0.ovh.netMail servers hosts at OVH
60gp.ovh.netMail servers hosts at OVH
vboxsvr.ovh.netShared hosting at OVH
cdn.tagcommander.comRequired for LaPoste webmail
ae01.alicdn.comRequired to display images in AliExpress
www.sugarsync.comRequired for SugarSync cloud synchronization.
lilo.orgSearchengine
www.ismonaco.orgUniversity
cpc.cxURL shortener of CanardPC.
simplelogin.fr, simplelogin.ioAntispam mail service
go.icann.orgNon-profit internet coordination organization
idp.impots.gouv.frFrench IRS
ipfs.scalaproject.ioIPFS Gateway
app.simplelogin.ioAntispam email
t.coTwitter URL shortener
transfer.shFile transfer service
woopic.comCDN used by Orange ISP
pushbullet.comAutomation API
l.bfmtv.comBFMTV short URLs


PS: If you find a domain which should not be blocked, please let me know (by email, Mastodon, Wire or Telegram).

Installation

Linux / MacOSX

You can paste this list at the end of your hosts file located at: /etc/hosts

Note: Some distributions require that 127.0.0.1 machineName is defined in host file. You can paste the blocklist after this line.

If you want to automatically update the blocklist, here is an example script which has to be run by root (you can just drop this script in /etc/cron.weekly/).

hosts-update
#!/bin/bash
# Update the DNS blocklist from the web
logger "hosts-update: Updating hosts."
tempname=`mktemp`
echo "127.0.0.1 `hostname`" > $tempname
printf "\n\n" >> $tempname
curl --fail https://sebsauvage.net/hosts/hosts >> $tempname
res=$?
if test "$res" != "0"; then
   logger "hosts-update: Failed to update hosts : $res"
   rm $tempname
   exit 1
fi
mv /etc/hosts /etc/hosts.old
mv $tempname /etc/hosts
chmod 0644 /etc/hosts
logger "hosts-update: hosts file successfully updated."

Windows

Under Windows, the "DNS Client" service seems to cause problems. It's a DNS cache. You must disable this service before installing this blocklist (run services.msc, right-clic on "DNS Client" > Properties > Startup: Disabled, then restart your computer).
Under Windows 10, even the administrator is not allowed to disable this service. Run regedit and put 4 (=disabled) in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Dnscache\Start then restart your computer.

You MUST disable DNS Client service before installing this blocklist. You have been warned.

You can paste this list at the end of your hosts file located at: C:\Windows\System32\drivers\etc\hosts

If this does not seem to work, run ipconfig /flushdns in a terminal.

If you want the host file to be automatically updated, you can try the freeware HostMan [NOT TESTED] : http://www.abelhadigital.com/hostsman/

Android

There are several Android applications capable to downloading and applying a blocklist. Please note that these applications use the VPN feature of Android. It's the only way for an application to collect network traffic of all other applications. You can use one of these applications:

As DNS filtering application use the VPN feature of Android, you cannot have your VPN and one of these three applications running simultaneously. It's either VPN or DNS filtering.

In each of these applications, disable the lists provided by default and add https://sebsauvage.net/hosts/hosts

For an extra layer of security, you can use alternate DNS resolvers such as Quad9 (9.9.9.9/149.112.112.112): This resolver also dynamically blocks botnets.

Update

I recommend updating the list every week.
Under Android, personalDNSFilter and DNS66 are capable of updating the list automatically on a regular basis.

Security

Keep in mind that this blocklist alone is not enough. You must:

FAQ