How to Clean Traffic at DNS Level Without Bloated Filter Lists
If you've ever set up a home Pi-hole or AdGuard Home, you've probably gone through a phase of gigantomania. I went through it myself: you find a couple dozen different blocklists, throw them into the resolver, and enjoy the counter showing three million blocked domains.
The joy usually lasts until the first evening. First, someone in the household loses authentication in their banking app, then messenger previews stop loading, and half of the necessary services require disabling the ad blocker. You end up spending hours sifting through request logs and hunting down false positives.
The 1Hosts repository by developer badmojr solves this problem with a completely opposite approach. The project has existed since December 2017 and focuses on compactness of lists without sacrificing filtering quality.
What's the Project's Idea
Many popular blocklists suffer from duplication and outdated entries. They have domains that have long been closed or changed owners hanging around for years. The resolver still wastes RAM storing them and searching through the rule tree.
The 1Hosts author curates rules so the list takes up minimum space but intercepts ads, trackers, and phishing resources. Instead of hundreds of scattered files, it offers just two basic versions, but in dozens of ready-made formats for specific software.
Two Versions for Different Scenarios
The project is split into two branches, and confusing them is difficult:
-
Lite — a balanced version based on the "set it and forget it" principle. It's aimed at everyday use at home or in the office. There's minimal risk of breaking normal websites, apps, or smart devices. False positives are kept to a minimum.
-
Xtra (currently in Beta) — a hardline option for privacy enthusiasts and those who want aggressive blocking. The list aggressively cuts telemetry, new suspicious domains, and controversial resources. Be prepared for some legitimate sites to break, and you'll need to manually add them to the whitelist or submit a report to the repository.
An interesting trick the author suggests: use the Lite version directly on a local device through the system hosts file, and put the more aggressive filtering higher up in the chain on the DNS server. This way, basic junk gets filtered locally and doesn't clutter your DNS resolver logs, while errors in edge cases are immediately visible in the network journal.
Formats for Any Software and Stack
The main headache when configuring network filters is syntax incompatibility. AdGuard uses one set of rules, Unbound requires its own config, and dnsmasq needs a separate format.
In 1Hosts, lists are automatically generated for most popular solutions:
- Standard hosts file (works for Windows, Linux, Android via AdAway)
- Domain lists for Pi-hole and OpenSnitch
- Rule format for uBlock Origin and AdGuard Home
- Configurations for local DNS daemons: dnsmasq, Unbound, Knot, Bind9, PowerDNS
- Rules for firewalls like Little Snitch
Here's what connecting the Lite version in a dnsmasq config looks like:
# Скачиваем готовый конфиг правил
curl -o /etc/dnsmasq.d/1hosts-lite.conf https://badmojr.github.io/1Hosts/Lite/dnsmasq.conf
# Перезапускаем службу
systemctl restart dnsmasq
If you run Unbound at home, just pull the generated configuration file using the include directive:
# В секции server файла unbound.conf
include: "/etc/unbound/1hosts-lite.conf"
Ready-Made Public DNS Without Deploying Your Own Server
Not everyone wants to set up their own server just to block trackers on their phone while traveling. The 1Hosts author anticipated this and prepared integrations with public secure DNS services that support DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT).
For instance, in ControlD the list updates every 30 minutes with wildcard rule support. You can simply enter the address in the private DNS settings on Android:
DoT: x-1hosts-lite.freedns.controld.com
DoH: https://freedns.controld.com/x-1hosts-lite
Similar profiles are configured for NextDNS, AdGuard DNS, and RethinkDNS. For mobile devices, this is often more than sufficient without installing third-party apps.
Support and Community
The repository has gathered over 2.1k stars and continues to be regularly updated. There are quite a few open issues, around nine hundred, but almost all of them are false positive reports. The maintainer promptly removes domains from the lists if they interfere with popular services.
The repository itself is distributed under the free MPL 2.0 license (Mozilla Public License). This allows you to freely use these lists as a foundation for your own builds or corporate filtering policies.
Who Should Try It
If you're tired of manually maintaining a monstrous combine of ten different blocklists, try resetting your settings and installing just the 1Hosts Lite version. For 95% of everyday home network tasks, it's more than enough: banners disappear, analytics gets blocked, and online store and banking pages continue to open without surprises.
The Xtra version is only worth trying for those who are consciously ready to deal with dropped requests and enjoy fine-tuning network rules to their needs.
Related projects