0xERR0R/blocky

Blocky is a DNS proxy and ad-blocker for the local network written in Go with following features:

• Blocking - Blocking of DNS queries with external lists (Ad-block, malware) and allowlisting

  • Definition of allow/denylists per client group (Kids, Smart home devices, etc.)
  • Periodical reload of external allow/denylists
  • Regex support
  • Blocking of request domain, response CNAME (deep CNAME inspection) and response IP addresses (against IP lists)

• Advanced DNS configuration - not just an ad-blocker

  • Custom DNS resolution for certain domain names
  • Conditional forwarding to external DNS server
  • Upstream resolvers can be defined per client group

• Performance - Improves speed and performance in your network

  • Customizable caching of DNS answers for queries -> improves DNS resolution speed and reduces amount of external DNS queries
  • Prefetching and caching of often used queries
  • Using multiple external resolver simultaneously
  • Low memory footprint

• Various Protocols - Supports modern DNS protocols

  • DNS over UDP and TCP
  • DNS over HTTPS (aka DoH)
  • DNS over TLS (aka DoT)
  • DNS over QUIC (aka DoQ, RFC 9250)
  • DNS over HTTPS/3 (aka DoH3, RFC 9114)

• Security and Privacy - Secure communication

  • Supports modern DNS extensions: DNSSEC, eDNS, ...
  • DNSSEC validation of upstream resolvers
  • Free configurable blocking lists - no hidden filtering etc.
  • Provides DoH Endpoint
  • Uses random upstream resolvers from the configuration - increases your privacy through the distribution of your DNS traffic over multiple provider
  • Blocky does NOT collect any user data, telemetry, statistics etc.

• Integration - various integration

  • Prometheus metrics
  • Prepared Grafana dashboards (Prometheus and database)
  • Logging of DNS queries per day / per client in CSV format or MySQL/MariaDB/PostgreSQL/Timescale database - easy to analyze
  • Various REST API endpoints
  • CLI tool

• Simple configuration - single or multiple configuration files in YAML format

  • Simple to maintain
  • Simple to backup

• Simple installation/configuration - blocky was designed for simple installation

  • Stateless (no database, no temporary files)
  • Docker image with Multi-arch support
  • Single binary
  • Supports x86-64, ARM, and MIPS architectures -> runs fine on Raspberry PI and OpenWrt routers
  • Community supported Helm chart for k8s deployment

Blocky is free, open source, and built entirely in my spare time — with no telemetry, no data collection, and no hidden filtering. It keeps the DNS for thousands of home networks, homelabs, and businesses clean and private, and it always will.

Maintaining a project this size — fixing bugs, reviewing pull requests, shipping new features, and keeping up with security — takes a lot of time. Thousands of people run Blocky; only a handful support it. If Blocky is useful to you, please consider chipping in. Your support directly funds ongoing development and helps keep Blocky independent and ad-free, forever.

Even a small recurring contribution makes a real difference and is hugely appreciated. 🙏

Thank you to everyone who supports Blocky! ❤️

You can jump to Installation chapter in the documentation.

You can find full documentation and configuration examples at: https://0xERR0R.github.io/blocky/

Issues, feature suggestions and pull requests are welcome!