DNS filtering is an easy way to block a vast majority of advertising, tracking and malware sites with a minimum of effort. This is quick to setup and easy to revert.

Advantages of DNS filtering:

• Filters a large quantity of advertising/tracking/malware without the need for additional software (Exception: Android needs additional software).
• Works under all OSes (Windows, Linux, MacOSX…)
• Works in all applications (and not only the browser)
• Under Android, gets rid of almost all advertising and tracking, including inside applications.
• Can be setup device by device, or on an entire network if configured on your router (pi-Hole, pfSense, etc.)
• Easy to setup.
• Fast.

Drawbacks:

• Does not filter everything.
• Some software may perform DNS resolution themselves instead of using the system DNS. They may therefore work around your DNS blocklist.

You do not need to worry: The setup is easy to reverse.

• Web advertising (smartadserver.com, doubleclick.net, googleadservices.com, googlesyndication.com, tradedoubler.com, adbrite.com, yimg.com(YahooAds)…), including site-specific domains (ad.paypal.com, ad.foxnetworks.com, ads.sun.com…), including first-party advertising and tracking.
• Malvertising (advertising networks known for spreading malware, trojan horses…) (adshufffle.com, conduit.com…)
• Advertising in mobile applications (admob.com, inmobi.com, mopub.com, adinfuse.com…)
• Web analytics (google-analytics.com, scorecardresearch.com, quantserve.com…)
• Mobile applications analytics (crashlytics.com, applovin.com, flurry.com…)
• Analytics/tracking from smartphone manufacturers (nmetrics.samsung.com, sdkconfig.ad.xiaomi.com, tracking.intl.miui.com…)
• Tracking services (canvas fingerprinting, evercookies…).
• First-party trackers.
• Social badges and buttons (addthis.com, badges.instagram.com, badge.stumbleupon.com…)
• Web site counters (sitemeter.com, free-counter.co.uk, webcounter.com, statcounter.com…)
• Fraudulent or malware sites (goggle.com, googfle.com, antivirus-scanner.com, adblock.fr, audacity.fr, myfuncards.com…)
• Popup-hell websites.
• Non-reliable download websites (softonic.com…)
• Sites linked to spam campains (buy-viagra.go.to, cheap-valium.polybuild.ru, forex-market.hut1.ru, norton-antivirus-trial.searchservice.info…)
• Websites designed to shock (goatse, 2girls1cup…)
• Domains linked to Windows 10 tracking/reporting/telemetry (reports.wes.df.telemetry.microsoft.com, feedback.microsoft-hohm.com, telemetry.appex.bing.net, statsfe2.ws.microsoft.com…)

This list is an aggregation of the following sources:

• https://adaway.org/hosts.txt
• https://someonewhocares.org/hosts/hosts
• https://raw.githubusercontent.com/notracking/hosts-blocklists/master/dnscrypt-proxy/dnscrypt-proxy.blacklist.txt
• https://winhelp2002.mvps.org/hosts.txt
• https://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&showintro=1&mimetype=plaintext
• https://hostfiles.frogeye.fr/firstparty-only-trackers-hosts.txt
• https://mirror.cedia.org.ec/malwaredomains/justdomains
• https://mirror.cedia.org.ec/malwaredomains/immortal_domains.txt
• https://www.malwaredomainlist.com/hostslist/hosts.txt

The blocklist is available in several formats:

These blocking lists make occasional mistakes. I have put some domains on a whitelist. These domains will never be blocked.

PS: If you find a domain which should not be blocked, please let me know (by email, Mastodon, Wire or Telegram).

You can paste this list at the end of your hosts file located at: /etc/hosts

Note: Some distributions require that 127.0.0.1 machineName is defined in host file. You can paste the blocklist after this line.

If you want to automatically update the blocklist, here is an example script which has to be run by root (you can just drop this script in /etc/cron.weekly/).

hosts-update

#!/bin/bash
# Update the DNS blocklist from the web
logger "hosts-update: Updating hosts."
tempname=`mktemp`
echo "127.0.0.1 `hostname`" > $tempname
printf "\n\n" >> $tempname
curl --fail https://sebsauvage.net/hosts/hosts >> $tempname
res=$?
if test "$res" != "0"; then
   logger "hosts-update: Failed to update hosts : $res"
   rm $tempname
   exit 1
fi
mv /etc/hosts /etc/hosts.old
mv $tempname /etc/hosts
chmod 0644 /etc/hosts
logger "hosts-update: hosts file successfully updated."

You can paste this list at the end of your hosts file located at: C:\Windows\System32\drivers\etc\hosts

If this does not seem to work, run ipconfig /flushdns in a terminal.

If you want the host file to be automatically updated, you can try the freeware HostMan [NOT TESTED] : http://www.abelhadigital.com/hostsman/

There are several Android applications capable to downloading and applying a blocklist. Please note that these applications use the VPN feature of Android. It's the only way for an application to collect network traffic of all other applications. You can use one of these applications:

• Blokada (sur F-Droid)
• DNS66 (sur F-Droid)
• DNSFilter (sur F-Droid)

In each of these applications, disable the lists provided by default and add https://sebsauvage.net/hosts/hosts

For an extra layer of security, you can use alternate DNS resolvers such as Quad9 (9.9.9.9/149.112.112.112): This resolver also dynamically blocks botnets.