Several DNS servers provide filtering against different categories, mostly for the local government 'undesirable content', some for malware, and some for ads. What I want is to create/use a DNS server that compare against those filtering DNS servers and only provide the address if all the DNS server agrees. For example if DNS server G provide a clean, unfiltered result, DNS server N provide malware and/or pornography filter, and DNS server F provide ad filter, then G, N and F will only provide the same/similar answer if the query is not categorized as malware, pornography, or advertising. Thus, by creating a server M that only answer if all DNS server agree, M effectively filter against all those categories. Maybe it's possible to do this on DDWRT or Tomato, but if not, I would settle for a solution that can be run in Linux/Windows.


I wouldn't try to combine results from multiple DNS servers with differing configurations, in the way you suggested.

Standard DNS

You can do this with normal DNS server software (e.g. BIND). One way involves a lot of work maintaining a list of blocked domains:

The suggestion at this site is to edit the config file to include

   zone "ads.x10.com" { type master; file "dummy-block"; };
   zone "advertising.com" { type master; file "dummy-block"; };
   zone "amazingmedia.com" { type master; file "dummy-block"; };
   zone "clickagents.com" { type master; file "dummy-block"; };
   zone "commission-junction.com" { type master; file "dummy-block"; };

where dummy-block is

   $TTL 24h
   @       IN SOA server.yourdomain.com. hostmaster.yourdomain.com. (
                  2003052800  86400  300  604800  3600 )
   @       IN      NS   server.yourdomain.com.
   @       IN      A
   *       IN      A

Someone memorably described this as killing an anthill one ant at a time.


BIND also supports RPZ which can be used with publicly available blacklists (so you don't have to maintain your own lists)


Some people feel a better solution is to use a HTTP-proxy such as Squid with Squidguard

SquidGuard is a URL redirector used to use blacklists with the proxy software Squid. There are two big advantages to squidguard: it is fast and it is free.

You can enforce the use of this by configuring rules in your router that only allow HTTP from the proxy server and disallow HTTP directly from any PC.

  • So.. using DNS result directly is a bad idea then? I can set DD-WRT for ad and malware blocklist already, but I kinda want better categorization and faster update from DNS server dedicated to malware and ads. – Martheen Cahya Paulo Apr 2 '13 at 11:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.