Blocklists and allowlists

Cloud DNS filters with three kinds of list. Blocklists hold the domains you want to block, allowlists hold the domains that must always resolve, and a list only takes effect once it is added to a ruleset. This guide covers creating and maintaining the lists. All of them live on the DNS tab of your Sign In context’s Service Gateway settings, in Cloud DNS mode.

Remote blocklists

A remote blocklist is a subscription to a published list of domains at a URL. Cloud DNS fetches the list, keeps it refreshed, and reports the result. This is the easiest way to block large, community-maintained categories such as ads, trackers, malware and phishing domains.

Remote blocklists show their fetch status, last-fetched time and entry count.

1. Add a remote blocklist

   On the Remote Blocklists tab, click Add Remote Blocklist. Give it a Name, paste the list’s URL, and leave Enabled on so it is kept refreshed. Save.

2. Check the fetch status

   The Status column reads OK once the list has been fetched, or Error if the URL could not be read. Use the row’s Refresh action to fetch again on demand, or Refresh all to re-fetch every enabled list in the background.

3. Review the contents (optional)

   Use the row’s Download content action to download exactly what was fetched. Export downloads the whole list of subscriptions, and Batch upload adds many subscriptions at once from a CSV.

Custom blocklists

A custom blocklist is a list of domains you maintain yourself, for the domains that are specific to your organization. It is not limited to security categories: a custom list can hold any policy you want to enforce, such as the streaming and social domains you want off a purpose-limited network. Type domains in one at a time, or paste a list you prepared elsewhere.

1. Create the list

   On the Custom Blocklists tab, click Add Custom Blocklist and give it a Name. Save.

2. Add domains

   Open the list’s Manage entries action and click Add Domain. A domain can be a single host such as betting.example, or a wildcard such as *.ads-tracker.example to cover a domain and everything under it. To add many at once, use Batch upload and paste one domain per line.

   

   List entries accept single hosts and wildcard domains.

Allowlists

An allowlist holds domains that must always resolve, even when a blocklist would otherwise block them. Allowlisted domains override every blocklist, so use an allowlist to protect the services your network depends on: payment providers, booking systems, your own services.

Allowlists are managed exactly like custom blocklists. On the Allowlists tab, click Add Allowlist, give it a name, then open Manage entries to add the domains that should never be blocked.

Once your lists exist, combine them into a ruleset to put them into effect.