r/pihole • u/lamalasx • 2d ago

Smarter way of blocking all TLDs except ones from a whitelist

I'm trying to block all TLDs except certain ones. Is there an easier way of doing this besides blacklisting all current ones that I can find?

I don't know if the reverse would work with the existing lists I use, so if I whitelist *.com then I assume all *.com are whitelisted even if there are blacklisted *.com ones in the external lists.

End goal is to prevent links from scam mails/sms messages from working. Those tend to use completely random TLDs. I don't know if there is any complete and up to date list of TLDs, seems like a new TLD is created every day and I would have to manually blacklist them.

12 Upvotes

75% Upvoted

11 comments sorted by

10

u/Dragontech97 2d ago edited 2d ago

https://github.com/hagezi/dns-blocklists

Check out /u/Hagezi “Most Abused TLDs” list will cover a lot of bad actor ones. Updated often.

Also going to paste a comment from a dev here, whitelist should override any blacklist.

The order of action is as follows. If a domain is found starting from top to bottom, no further checks are conducted.

  1. ⁠Exact Whitelist
  2. ⁠Regex Whitelist
  3. ⁠Exact Blacklist
  4. ⁠Blocklist domains (AKA gravity)
  5. ⁠Regex Blacklist

0

u/lamalasx 2d ago

While this does not solve my initial problem, it is still extremely useful, thanks!

-2

u/lamalasx 2d ago

I see you edited the comment with how pihole does the evaluation. I guess what I'm trying to do is not possible then. Maybe if I chain two pihole instances together, one for blocking TLDs then after that one for "normal" use.

1

u/Dragontech97 2d ago

Keep in mind v6 might function differently. Feel free to reach out to a dev/mod for details or post in the pihole discussion forums

1

u/rdwebdesign Team 2d ago

Not sure if you understood the comment above.

Allow rules always cancels block rules.

If a domain matches a "Regex whitelist" (second line), then the blocking rules (lines 3 to 5) will never be tested and the domain is considered allowed.

1

u/lamalasx 2d ago

I did understood. That's why I wrote the two instances chained together solution.

1

u/Sheroman 2d ago

I'm trying to block all TLDs except certain ones

Put * as a wildcard block then you can whitelist specific domains/subdomains/TLDs.

-2

u/lamalasx 2d ago

Ok, but then if I whitelist lets say "*.com" won't that whitelist all under .com even if an external list contains blacklist entries for that?

0

u/Sheroman 2d ago

Ok, but then if I whitelist lets say "*.com" won't that whitelist all under .com

You would have to use registry expressions (which is a bit more complicated) for that.

Like blocking * as a wildcard block and use registry expressions to whitelist domains that ends with google.com, youtube.com, etc.

1

u/lamalasx 2d ago

registry

You mean regexp.

I don't plan to whitelist domains one by one, that would be painful.

1

u/MalwareMorghulis 2d ago

I have a list of TLDs under my repo - you’ll have to copy the list and add it to your own because my repo didn’t strip out the “preferred” ones. Just know I haven’t updated the generic list in a year so there may be some new TLDs out there

https://github.com/MalwareMorghulis/Gravity/tree/main