This repository is the data pipeline used by Mullvad VPN to produce DNS blocklists for ads, trackers, adult content, gambling, social media, and malware. It ingests multiple upstream blocklists (from oisd, hagezi, AdGuard, Firebog, etc.) and custom lists via an Ansible playbook, cleans and normalizes them (removing localhost IPs, comments, special characters), combines them by category, and outputs plain-text domain lists and RFC-compliant zone files for both encrypted DNS (DoH) and VPN relay servers. The output files are GPG-signed for integrity. A CI workflow validates zone files using named-checkzone. The repository also includes scripts for generating social media blocklists by enumerating subdomains (via subfinder) and fetching IP ranges for major social platforms (Facebook, TikTok, Snapchat) using ASN lookups. While tightly coupled to Mullvad's infrastructure, the ETL pattern and zone file generation logic are well-structured and could be adapted for similar DNS blocking pipelines.