Which DNS blocklist should I use?

The short answer

For a home network: HaGeZi PRO plus HaGeZi TIF. Add OISD Big if you like a second opinion. That combination blocks ads, trackers, telemetry, fake shops, phishing and malware with very few broken sites. Everything else on this page is optional.

HaGeZi Multi – five tiers

The tiers build on each other – pick exactly one. The ad block test tells you which tier you are effectively running.

HaGeZi standalone lists

• TIF (Threat Intelligence Feeds): malware, phishing, botnets, scams. Huge but safe – recommended with every tier. Medium and Mini versions exist for small devices.
• Fake (in Normal and above) and Pop-Up Ads (in PRO and above): only needed if you run Light or Normal.
• DoH/VPN/TOR/Proxy bypass, DynDNS, Badware Hoster, URL Shortener, Abused TLDs: security lists for locked-down networks. They block legitimate services too.
• Gambling, Social, NSFW, Anti Piracy, Safesearch: content and parental filters. Taste, not security.
• Native Tracker per vendor (Apple, Microsoft, Samsung, Xiaomi, Amazon, Huawei, LG, Roku, Vivo, OPPO, TikTok): telemetry baked into devices. Partly included in the tiers, fully in ULTIMATE.

OISD

OISD is one balanced list built from many sources with a strict “don’t break anything” policy. Big is the full list, Small a trimmed variant for weak hardware, and there are NSFW variants. OISD overlaps heavily with HaGeZi PRO; running both costs nothing but memory.

URLs by blocker

Same domains, different file formats. Pick the row for your software.

Other tiers and lists follow the same pattern: replace pro with light, multi (Normal), pro.plus, ultimate, fake, popupads, gambling, social, nsfw and so on. Sources: HaGeZi on GitHub, oisd.nl.

Pair it with a browser blocker

DNS blocking stops requests to other domains. It cannot remove ads that come from the same domain as the content – YouTube, Twitch, Instagram – or hide empty ad slots. Run uBlock Origin or AdGuard in the browser on top, then test both together here.

All 39 lists at a glance

Every list the test checks against, with the Technitium URL and links to the other formats. Newly-registered-domain (NRD) and DNS-rebind lists live in HaGeZi’s repository and are not covered by the test.