hagezi/dns-blocklists is the closest thing to a plug-and-play DNS ad blocker for self-hosters, and in a weekend of testing on a Pi-hole we kept coming back to it. The repo ships five tiers of blocklists — Light, Normal, Pro, Pro++, and Ultimate — that range from roughly 41k to 269k domains, so you pick the trade-off between coverage and false positives yourself. For most home setups we’d point you at the Pro tier first.
Why the tier system matters
The smart move here is that hagezi doesn’t force one giant list on everyone. Each tier layers on different filter categories rather than just adding more domains, and that is what keeps the aggressive lists usable. Light covers the obvious ad domains. Pro adds telemetry, analytics, and fingerprinting trackers. And Ultimate throws everything at the wall — including a good chunk of sites you’d never expect to hit. Because the lists build on each other, you can start small and climb only if the extra coverage is worth the breakage risk.
| Tier | Approx. entries | Best for |
|---|---|---|
| Light | ~41k | Low-risk home browsing, minimal false positives |
| Normal | ~85k | Everyday ad + tracker blocking |
| Pro | ~125k | Privacy-focused homes, adds telemetry/analytics |
| Pro++ | ~180k | Aggressive blocking, some false positives |
| Ultimate | ~269k | Max coverage, expect breakage on niche sites |
In our test, the Pro list dropped into a Pi-hole and the query log climbed past 35% blocked within the first hour. That number alone sold us on the tier approach. AdGuard Home, Blocky, OPNsense, and TechnitiumDNS all accept the same feed, so the tier choice is portable — you’re not locked to one platform the way you are with some single-format lists. Honestly, that cross-platform reach was the detail that tipped us toward recommending it.
Formats that match your DNS setup
Most blocklist projects assume you run one DNS server and format everything for it. hagezi publishes each list in multiple flavors — adblock-style syntax, dnsmasq, wildcard, and RPZ — alongside hosts and a plain domains file. That mattered more than we expected. Our OPNsense box wanted RPZ, the test Pi-hole took the standard adblock URL, and we pulled the domains-only file into a quick script without touching any of the others. Yet few projects bother, and fewer still keep every format current. Here’s the practical upside: one subscription URL is all you keep track of no matter how many devices you cover.
The specialized feeds are the real differentiator
The tiered lists get the attention, but the repo’s niche feeds are what make it stand out as a DNS threat intelligence source. There’s a dedicated threat-intelligence-feed (TIF) list, a list that blocks DoH, VPN, and Tor exit bypass attempts, plus an NRD (newly registered domains) list and one aimed at DNS rebinding protection. For anyone running a home lab that faces the public internet, the DNS rebind feed alone justified the setup time. Even so, these are specialist tools — most people never need more than the main tiers.
Hands-on: a weekend on Pi-hole
In practice, the whole install took about ten minutes. We added the Pro URL to the Pi-hole blocklist menu, ran a gravity update, and the list parsed clean on the first try — no formatting errors, no orphaned comments. But the honest catch came with Ultimate. We browsed to a smaller blog and the ad-free version broke a login widget; Pro caught nothing like that in the same session. So the tier ladder really does behave the way the docs promise. The project is clearly maintained, with the repo updated on August 2, 2026 and sitting at 24.9k stars, so this isn’t abandoned code. If you’re new to self-hosted filtering, our Cloudflare Gateway and Pi-hole scripts guide walks through the setup side of this.
Bottom line
For anyone running Pi-hole, AdGuard Home, or a router-based DNS filter, hagezi DNS blocklists is a top-tier choice because the tier system removes the guesswork from balancing coverage against breakage. Start on Pro, drop to Normal if a service you rely on breaks, and reach for the specialized feeds if your setup faces the open internet. It’s free, actively maintained, and portable across every major DNS platform — which is about all you can ask from a blocklist in 2026. While a dedicated threat feed won’t replace a proper firewall, as a first line of DNS defense it earns its keep.