Blocky is a DNS proxy and ad-blocker for the local network, written in Go by the developer behind the 0xERR0R GitHub account. It sits between your devices and the public DNS, answering lookups from its own cache, filtering names against ad, tracker and malware lists that it refreshes on a schedule, and forwarding everything else to upstream resolvers that you choose. Unlike a browser extension it protects the whole network — phones, televisions, smart speakers and IoT gadgets that offer no extension mechanism of their own — and unlike a plain hosts file it is considerably more than a blocklist: per-client policies, conditional forwarding, custom local records, DNSSEC and modern encrypted transports (DoT, DoH, DoQ and DoH3) all live in the same single YAML file. It is stateless by design — no database, no temporary files — and ships as one static binary or a multi-arch container image. The current release is v0.35.0 (September 2026).

Key Features

• Ad, tracker and malware blocking — named denylist groups assembled from external lists (StevenBlack hosts, Disconnect, any plain URL) or local files, assigned per client group so one policy can apply to the laptops, another to the children’s tablets and another to smart-home devices. Allowlists take precedence over denylists, inline entries and regular expressions are accepted, and lists are re-downloaded on a configurable refresh period.
• Deep response inspection — blocking works on the requested domain, on a CNAME found inside the upstream answer, and on the response IP address against IP lists, so a tracker reached through a rebranded alias is still caught.
• Real DNS features, not just blocking — custom DNS records for local names, conditional forwarding per domain (send fritz.box to the router and everything else upstream, with an optional fallback), per-client-group upstream resolvers, rewrite rules, and DNS rebinding protection that re-inspects cached answers.
• Modern transports — plain DNS over UDP and TCP plus DNS-over-TLS, DNS-over-HTTPS, DNS-over-QUIC (RFC 9250) and DNS-over-HTTPS/3, with DNS stamps (sdns://…) accepted for upstream configuration and certificate pinning.
• Caching and prefetching — configurable minimum and maximum answer TTLs, an entry-count ceiling for hosts with little memory, and prefetching of frequently queried names so repeat lookups are served from memory. Several upstream resolvers are used in parallel and selected at random per query, which spreads traffic across providers rather than leaking a complete browsing profile to one.
• Operational integration — a Prometheus metrics endpoint with prepared Grafana dashboards, query logging to CSV or to MySQL/MariaDB/PostgreSQL/TimescaleDB, per-client and per-day statistics, a REST API, and a built-in CLI (blocky query, blocky lists refresh, blocky blocking enable|disable, blocky stats, blocky healthcheck) for scripting and container health checks.
• Simple, honest deployment — a single YAML file (or a directory of them, joined at startup) with a published JSON schema for editor validation and autocomplete; one static binary; multi-arch containers; per-client query rate limiting that drops, rather than refuses, abusive traffic; and no telemetry, no user-data collection and no hidden filtering.

Why Use It

Network-wide blocking is the only approach that covers the devices you cannot install software on, and Blocky is the option to reach for when you want that filtering to stay yours: the lists, the upstreams and the query logs all live on your own hardware, and the resolver reports to nobody. Because it is stateless and a single binary, it fits where a full Pi-hole-style stack would be overkill — an OpenWrt router, an ARM single-board computer, a container alongside the rest of a Compose stack, or a Kubernetes cluster through the community Helm chart. The per-client-group model is what sets it apart from simpler blockers: you can enforce a strict list on the children’s devices, keep a light one on your own workstation, and exempt whatever breaks when a domain is blocked — all from the same process and the same configuration file.

Use Cases

• Whole-home ad and tracker blocking — point the router’s DHCP DNS setting at Blocky and every device on the LAN is filtered with no per-device configuration.
• Parental controls — give selected clients their own group with a stricter denylist and optional named schedules for weekday and weekend windows, leaving the rest of the household unfiltered.
• Split-horizon DNS and local names — serve printer.lan or nas.home from custom mappings and forward internal domains to the network’s own resolver, with a fallback to the upstream for names that server does not know.
• Privacy on untrusted networks — wrap upstream queries in DoT, DoH or DoQ so the ISP or a café access point sees only encrypted traffic to a resolver you trust.
• DNS observability — write query logs to a database and correlate them in Grafana, or scrape the Prometheus endpoint for per-client and per-domain statistics.

Platform

Linux, macOS, FreeBSD, NetBSD and OpenBSD builds are published for x86-64, ARM (32- and 64-bit) and MIPS, so it runs on a Raspberry Pi, an OpenWrt router or a small VPS · distributed as a single static binary and as spx01/blocky / ghcr.io/0xerr0r/blocky container images (the image runs as unprivileged UID 100 with NET_BIND_SERVICE permitted, so it starts even under a restricted runtime that drops all capabilities) · community packages exist for the AUR, Alpine, FreeBSD ports, Gentoo GURU, NixOS, Homebrew, TrueNAS SCALE and Kubernetes via Helm · needs to bind port 53 (or a port above 1024 when run unprivileged) plus an HTTP port for the API and metrics.

Licence

Apache-2.0 — free and open source, permissive, with no feature gating, account or paid tier. Development is funded by voluntary donations (GitHub Sponsors, Liberapay, Ko-fi, PayPal); Blocky collects no telemetry and no usage statistics.

Website

0xerr0r.github.io/blocky · source on GitHub · releases · also see the Security & Privacy category and the full directory for more tools that keep a network honest, including AdGuard Home for a GUI-first network-wide blocker and Unbound for a validating recursive resolver to put in front of it.