Names and DNS

Filtering resolver

Also called DNS filtering, DNS blocklist, sinkhole, Pi-hole, Quad9, family filter, RPZ

A resolver that refuses names on a blocklist: it answers NXDOMAIN or a block page without looking them up.

Used against ads, trackers, malware and phishing (Quad9, OpenDNS, Cloudflare 1.1.1.3, Pi-hole, a company's resolver). A blocked name covers everything under it, so one entry too broad blocks a whole zone. The filter binds only those who ask it: another resolver, or an address already known, goes around it. Its made-up NXDOMAIN has no SOA record, which tells it from a real one.

See it on real machines

Learn it on real machines.