$ show mullvad/dns-blocklists
This repository is the data pipeline used by Mullvad VPN to produce DNS blocklists for ads, trackers, adult content, gambling, social media, and malware. It ingests multiple upstream blocklists (from oisd, hagezi, AdGuard, Firebog, etc.) and custom lists via an Ansible playbook, cleans and normalizes them (removing localhost IPs, comments, special characters), combines them by category, and outputs plain-text domain lists and RFC-compliant zone files for both encrypted DNS (DoH) and VPN relay servers. The output files are GPG-signed for integrity. A CI workflow validates zone files using named-checkzone. The repository also includes scripts for generating social media blocklists by enumerating subdomains (via subfinder) and fetching IP ranges for major social platforms (Facebook, TikTok, Snapchat) using ASN lookups. While tightly coupled to Mullvad's infrastructure, the ETL pattern and zone file generation logic are well-structured and could be adapted for similar DNS blocking pipelines.
The LLM identified 4 files worth highlighting for reuse:
The final tasks in the playbook generate zone files from plain-text domain lists. They read each .txt output, wrap it in a standard SOA/NS header, and pipe through named-checkzone for validation. This pattern is reusable for any project that needs to convert domain lists into valid DNS zone files.
A Python script that fetches IP network ranges for given ASNs (Facebook, TikTok, Snapchat) from ipinfo.app and outputs them in a format suitable for RPZ (response policy zone). This is reusable for generating DNS-level blocking for entire ASNs.
A bash script that iterates over all .txt and .zone files in the output directories, constructs temporary zone files for the .txt files, and runs named-checkzone on each. This is a reusable validation script for any DNS zone file repository.
A shell script that uses subfinder to enumerate subdomains for a list of social media domains, then combines them with the domain list and ASN-generated entries into a single blocklist file. The pattern of using subfinder for comprehensive domain discovery is reusable, though the output paths are specific to this repo.