I started this project after reviewing my Pi-hole query history and finding allowed DNS queries to hostnames associated with advertising and tracking. I wanted to compare what my network was requesting with what my downloaded blocklists actually covered.
Two examples from the historical database review were:
Those totals include forwarded queries and responses from cache, including stale cache. They count DNS queries—not ads displayed, tracking uploads, or successful HTTP connections.
Neither hostname was covered by the four downloaded source snapshots checked during that initial review, including their parent-domain rules. That establishes a gap in those particular snapshots. It doesn’t establish deliberate omissions, explain every historical allowed response, or mean the domains remain unblocked today.
What I built
Using AI to assist with scripting and analysis, I compared query-log domains with the source lists, consolidated overlapping rules, and incorporated reviewed custom additions.
The source feeds now include:
- StevenBlack’s hosts list
- Zach’s advertising list
- kboghdady’s YouTube-focused list
- OISD Big
- HaGeZi Pro
I’m a heavy Plex Media user, so preserving Plex was a priority. The build applies local exclusions for services I want available, including Plex, Roon, and WeChat. For example, I chose to exclude analytics.plex.tv. That’s my compatibility preference, not a claim that the hostname is essential to all Plex installations.
I run two Pi-hole containers on separate Synology NAS boxes: Prime and Alternate. Both retrieve one master TXT hosted locally through Synology Web Station.
This distributes the same adlist to both instances. It doesn’t synchronize their full configurations, local DNS records, or individual allow/deny entries.
What the screenshots show
With five individual feeds enabled, both dashboards displayed 571,559 domains on lists. With the custom master enabled, both displayed 558,605, a reduction of 12,954.
Those are Pi-hole’s displayed counts. The difference reflects the resulting build and exclusions; it isn’t a measurement of raw duplicate entries removed. Pi-hole already deduplicates overlapping entries when building Gravity, so my main benefit is centralized maintenance and control over custom additions and exclusions.
The screenshots also aren’t a controlled before-and-after test of blocking effectiveness.
What is automated now
A script runs through Synology Task Scheduler to:
- Download the source feeds.
- Normalize, merge, and deduplicate supported rules.
- Apply my custom additions and exclusions.
- Report changes against the previous master.
- Publish the resulting TXT into the Web Station serving folder.
The refresh is scheduled for midnight, with Gravity updates on both Pi-holes scheduled for 12:10 AM. That ten-minute interval is scheduling separation, not a dependency check proving the refresh completed successfully.
What is planned next
I want to automate AI-assisted traffic and coverage reviews whenever the master updates. Each run would use a consistent snapshot of each Pi-hole’s pihole-FTL.db, compare historical allowed queries with the updated rules, and produce candidate additions with supporting evidence.
AI-proposed additions would be reviewed before publication. This is planned work, separate from the current automated feed refresh. It would be a blocklist coverage review—not a general vulnerability scan or proof of what an application transmitted.
For me, this has been a learning project and a way to maintain one inspectable list tailored to my household. Credit belongs to the upstream maintainers for their lists; my work combines their feeds with local observations and preferences.
I’d welcome suggestions on validation, false-positive handling, and making the scheduled publishing process more robust.
