Skip to main content
DNZ can block ads, trackers, malware or specific sites right in DNS. A device asks for a blocked name and gets an answer that goes nowhere, so the ad or tracker never loads. You subscribe to shared blocklists, add your own allow and block rules, and test any domain to see why it is blocked. Lists and rules can apply to some clients only and to some hours only, and safe search and parental control keep a child’s devices clean. Filtering lives under DNS → Filtering, and in the CLI under dnz filter.

​
Scopes

The division is picked from the client’s IP address. A superadmin maps networks to divisions in the Client networks card, for example 10.10.0.0/16 → SIMRS and 10.20.0.0/16 → Marketing. When networks overlap, the most specific one (longest prefix) wins. Only superadmins can map networks, so one division can’t claim another division’s devices. Until a network belongs to a division, that division’s lists don’t apply to any device.

​
Get started

1

Add a blocklist

Open DNS → Filtering. In Blocklists, click one of the suggested lists, or paste the URL of any list you trust (with an optional name). The list is downloaded right away.
2

Map client networks (per-division filtering)

As a superadmin, add each division’s networks in Client networks, for example 10.20.0.0/16 for Radiology.
3

Test a domain

Type a domain in Test a domain, optionally with a Client IP, to check that it is blocked.

​
Order of decisions

For each query, DNZ decides in this order:
  1. Local zones are always answered and never blocked.
  2. Allow (your own rule, or an @@||domain^ entry in a list) beats block. A division’s allow also beats a server-wide block.
  3. Response policy zones (RPZ feeds, server-wide), see Response policy zones.
  4. Block from a list or your own rule.
  5. Safe search: a search engine’s name is answered with its safe variant.
  6. Anything else is forwarded upstream as usual (see Forwarding).
Lists and rules limited to some clients or a schedule only take part while they apply: an allow rule for Kids tablets only beats a block for those devices. An entry covers the domain and all its subdomains: doubleclick.net also blocks ad.doubleclick.net.

​
Blocklists

  • One-click buttons for popular lists: AdGuard DNS filter, Steven Black hosts, HaGeZi Multi Light, OISD small and HaGeZi Threat Intelligence. You can also enter your own URL.
  • A list is downloaded when you add it, then updated automatically every 24 hours. The ⟳ button updates it now (dnz filter list refresh 2).
  • If a download fails, the old contents stay in use and the error is shown.
  • Up to 64 MB per list.
  • A list can be turned off without deleting it (dnz filter list set 2 off).

​
Formats

  • hosts: 0.0.0.0 ads.example.com
  • AdGuard / Adblock: ||ads.example.com^, @@||ok.example.com^
  • One domain per line: ads.example.com (a leading *. is ignored)
Cosmetic rules, regexes and rules with modifiers ($client=…) are skipped. To get the effect of $client, limit the whole list to some clients instead (see Clients).

​
Your own rules

Your rules block or always allow single domains on top of the lists. Each rule can carry a note. Allow wins over any block.

​
Clients: rules for some devices only

Like AdGuard’s $client, any list, rule or the safe search settings can be limited to some clients. Open a list’s ⋯ → Clients & schedule… (or the sliders button on a rule) and pick Only some clients:
  • Named clients from the Clients card: a name for a group of addresses, for example Kids tablets → 192.168.1.50, 192.168.1.51 or Guest Wi-Fi → 192.168.50.0/24. Rename it or change its addresses later, and every list and rule that uses it follows.
  • Addresses and networks typed straight in: 192.168.1.50, 10.0.5.0/24, 2001:db8::/64.
1

Name the devices

In the Clients card, add a client with a name, such as Kids tablets, and its addresses or networks.
2

Limit a list or rule

Open a list’s ⋯ → Clients & schedule…, or the sliders button on a rule, choose Only some clients and pick Kids tablets.
A client group is in a scope like lists are: a division’s groups are only for its lists and rules, and the server-wide ones can be used everywhere. A group can’t be deleted while a list or rule still uses it (they would silently apply to no one), and neither can a schedule. In a division, limiting to clients narrows the division’s devices further; the division itself still comes from the client networks. In the server-wide scope, client limits work for any device, with no divisions involved.

​
Schedules

A schedule is a set of days and a time range, in the server’s time zone (Settings → General). For example: Pick one in Clients & schedule… to apply a list or rule only then: block Games during school hours, or Social media at bedtime for Kids tablets. Outside the schedule the list or rule does nothing. A night schedule belongs to the day it starts on: Bedtime on Sunday covers Sunday 21:00 to Monday 06:00.
--days takes mon,tue,…, a range like mon-fri, weekdays, weekend or daily. Safe search answers search engines with their safe variant, which hides explicit results in every browser and app on the device. The engines document these names for networks to use: The answer is a CNAME to the safe name plus its addresses, looked up through the upstreams (and the cache, and forwarding rules). Blocking wins over safe search; an allow rule doesn’t turn it off. Safe search is set per scope. A division can have its own settings, which then replace the server-wide ones for its devices; Follow server-wide removes them again. Safe search can be limited to clients and a schedule too. Answers show up in the query log as safe search.
Check it from a device’s point of view:

​
Parental control

The Parental control card offers blocklists by category, from HaGeZi and the Block List Project: Each one you add is an ordinary blocklist, with the category shown next to it, so it updates daily and can be limited to some clients and a schedule like any other list. For a child’s devices: add a client group for them, add the categories, then limit each list to that group.
parental add subscribes to a category’s first list, or to all of them with --all.

​
Response policy zones

Superadmins can also subscribe to RPZ threat feeds, by zone transfer or URL, and serve DNZ’s own server-wide lists as an RPZ zone for BIND, Unbound or PowerDNS. See Response policy zones.

​
Answers for blocked queries

A superadmin sets this in the server-wide scope under Blocked answers:
Blocked answers have a TTL of 60 seconds, so unblocking reaches clients quickly.

​
Check and monitor

  • Test a domain shows whether a domain is blocked, by which entry and from which list (or which RPZ rule), whether that entry is only for some clients or a schedule, and whether safe search rewrites it. Fill in Client IP to see it from a particular device’s point of view: its division comes from the client networks, its client groups from their addresses. Schedules are checked at the current time. The Allow and Block buttons add a rule straight away.
  • Query Logs → All queries → Blocked lists every blocked query (blocklists and RPZ) with the client’s IP (see Query logs).
  • Every change to lists, rules and networks is recorded in the audit log.

​
Troubleshooting

Run Test a domain (or dnz filter check <domain> --client <ip>) to find the entry and the list behind it, then click Allow. A division’s allow beats a server-wide block, so a division owner can unblock a site for their own devices.
Check that the device’s address is in one of the division’s Client networks, and that no more specific network belongs to another division. Only superadmins can add networks.
Run Test a domain with the device’s Client IP. Check that its address is in the client group, and, for a list with a schedule, that the schedule covers the current time in the server’s time zone (Settings → General).
Browsers that use their own encrypted DNS (DoH) bypass DNZ. Turn that off in the browser, or point it at DNZ’s encrypted DNS. Blocking also wins over safe search, so check that the search engine isn’t on a blocklist.
Local zones are always answered and never blocked. Remove or turn off the record instead.