Parental control

The Parental Control page restricts what devices on the profile can reach. It has three parts:

Control	What it does
Restricted modes	SafeSearch answers Google, Bing and DuckDuckGo search hosts with the vendor’s safe endpoint (`forcesafesearch.google.com`, `strict.bing.com`, `safe.duckduckgo.com`). YouTube restricted mode answers YouTube hosts with `restrict.youtube.com` (YouTube’s Strict level).
Blocked categories	whole kinds of sites, from public lists, curated domains and the services in the category (Categories)
Blocked services	one named app or site with every domain it uses (Services)

Every category and service starts off. A badge at the top counts what the profile blocks.

Blocked categories lists each category with its description, how many domains and services it holds, and its sources with their licences. Cloud only marks a category with a source whose licence is still under review (below). Not in the current build marks a category the latest list build does not carry; it is greyed out and cannot be switched on until it is back.
Blocked services is grouped by category, with a search box that matches names, ids and domains. Each service says what else it may also affect, lists its other categories and when it was last reviewed, and Show N domains lists exactly what it blocks. Read the note before blocking: several services share infrastructure.

If the profile holds an id the catalogue does not know, the page lists it under Not in the catalogue, so these block nothing, with a button to remove it. Profiles created before the catalogue had three category ids renamed (social-networks to social, games to gaming, video-streaming to streaming); the page converts them once, with a notice, and what they block is unchanged.

How they interact with your rules

Parental controls are step 5 of the policy order:

The allowlist beats blocked categories and services. An allowlisted name is let through even if it is in a blocked category.
The allowlist does not turn SafeSearch or YouTube restricted mode off. They are rewrites, not blocks, and still apply to allowlisted names.
A blocked service beats the restricted modes. With YouTube blocked, YouTube’s names are blocked rather than rewritten to restricted mode.
Your own rewrite of a name wins over all of them.
Security lists (step 4) are checked first: a name that is both malware and in a blocked category is reported as the security block.

A blocked name gets your profile’s block answer with Extended DNS Error 17 and the list name as extra text: category-<id> or service-<id>, for example service-tiktok. The same name shows in the log entry.

Where the domains come from

A service is a curated list of the domains the vendor uses, reviewed by a person: registrable domains and the vendor’s own CDN and API hosts, never shared parents such as google.com or akamaized.net. Each rule blocks the name and everything under it.
A category merges three things: its public sources (each with a recorded licence), curated domains written in the repository, and the domains of every service in it. Blocking Social networks therefore also blocks TikTok and Instagram.

The data, its review rules and how to propose a change are in data/parental/README.md. Every change is a reviewed pull request. A false positive or a missing domain can be reported through the abuse desk.

Self-hosted nodes

An enrolled or standalone node receives the public list artifact. Public sources whose licence is still under review for redistribution are cloud only: the cloud resolver uses them, the public artifact never carries them. Curated domains and service lists are always included. On a node, a category marked below as having cloud-only sources therefore blocks less than the same category on the cloud addresses.

Choosing by API

The catalogue needs no account: GET /v1/parental/categories and GET /v1/parental/services return the same data as the tables below, with each list’s entry count in the latest build and whether the build carries it (available). A profile blocks by id, in its parental settings:

{
  "parental": {
    "categories": ["gambling", "adult"],
    "services": ["tiktok", "roblox"],
    "safe_search": true,
    "youtube_restricted": true
  }
}

Categories

cloud only marks a public source whose licence is still under review for redistribution: the opdns cloud resolver uses it, but the list artifact sent to self-hosted nodes never contains it, so a node’s copy of that category is smaller.

Category	Id	Fed by	On self-hosted nodes
Adult content	`adult`	4 public sources	all but 1 cloud-only source
Gambling	`gambling`	4 public sources	everything
Dating	`dating`	1 public source, 10 curated domains, 4 services	everything
Drugs	`drugs`	2 public sources	everything
Weapons	`weapons`	8 curated domains	everything
Violence and gore	`violence`	1 public source, 6 curated domains	everything
Piracy	`piracy`	3 public sources	everything
VPN, proxies and filter bypass	`proxy-vpn`	2 public sources	everything
Social networks	`social`	2 public sources, 10 services	everything
Online gaming	`gaming`	1 public source, 10 services	everything
Video and music streaming	`streaming`	1 public source, 11 services	everything
Messaging and chat	`messaging`	1 public source, 6 services	everything
AI chatbots	`ai`	9 curated domains, 5 services	everything

Adult content

Pornography and sexually explicit websites. Id adult, list 80.

Includes: Sites whose main purpose is sexually explicit images, video, live cams or stories, and their media hosts.
Excludes: Sex education, sexual health, LGBTQ+ community and support sites, lingerie retail, dating (see dating).
Public sources:
- HaGeZi NSFW, GPL-3.0-only
- OISD NSFW, GPL-3.0-only
- StevenBlack porn-only extension, MIT cloud only
- Block List Project porn, Unlicense

Gambling

Online casinos, sports betting, poker and lotteries played for money. Id gambling, list 81.

Includes: Real-money casinos, betting exchanges and bookmakers, online poker, paid lotteries and their affiliates.
Excludes: Regulator and problem-gambling support sites, sports news and scores, free-to-play social casino games.
Public sources:
- HaGeZi Gambling, GPL-3.0-only
- StevenBlack gambling-only extension, MIT
- Block List Project gambling, Unlicense
- UT1 gambling, CC-BY-SA-4.0

Dating

Dating sites and apps, including hook-up apps. Id dating, list 82.

Includes: Services whose main purpose is meeting romantic or sexual partners.
Excludes: General social networks, friendship features of other apps, marriage registries and wedding planning.
Public sources:
- UT1 dating, CC-BY-SA-4.0
Curated domains: badoo.com, eharmony.com, happn.com, lovoo.com, match.com, meetic.com, okcupid.com, plentyoffish.com, pof.com, zoosk.com
Services that also feed it: Tinder, Bumble, Hinge, Grindr

Drugs

Sale and promotion of illegal drugs, and vaping and drug-paraphernalia shops. Id drugs, list 83.

Includes: Online drug markets, recreational-drug promotion, vape and head shops.
Excludes: Harm-reduction, addiction support, pharmacies, medical and scientific information.
Public sources:
- Block List Project drugs, Unlicense
- UT1 drogue, CC-BY-SA-4.0

Weapons

Online sale of firearms, ammunition and weapon parts. Id weapons, list 84.

Includes: Firearm and ammunition marketplaces and retailers, classified ads for guns.
Excludes: Hunting and shooting-sport federations, news, museums, video games.
Public sources: none; curated in the repository only.
Curated domains: ammoseek.com, armslist.com, budsgunshop.com, cheaperthandirt.com, gunbroker.com, guns.com, gunsamerica.com, palmettostatearmory.com

Violence and gore

Graphic violence, gore and hate sites. Id violence, list 85.

Includes: Sites whose main purpose is real footage of death, injury or torture, and sites promoting hate or violence.
Excludes: News reporting, history and war documentation, fiction, horror films and games.
Public sources:
- UT1 agressif, CC-BY-SA-4.0
Curated domains: crazyshit.com, documentingreality.com, goregrish.com, kaotic.com, theync.com, watchpeopledie.tv

Piracy

Includes: Torrent and warez indexes, illegal streaming and IPTV, cracked software, file lockers used for piracy.
Excludes: BitTorrent clients and protocol sites, open-source software mirrors, legal free streaming.
Public sources:
- HaGeZi Anti-Piracy, GPL-3.0-only
- Block List Project piracy, Unlicense
- UT1 warez, CC-BY-SA-4.0

VPN, proxies and filter bypass

VPN services, web proxies, Tor gateways and public encrypted-DNS resolvers that bypass the filter. Id proxy-vpn, list 87.

Includes: Consumer VPN providers, anonymising web proxies, Tor2web gateways, public DoH and DoT resolvers.
Excludes: Corporate remote-access products, privacy news and guides, the opdns resolvers themselves.
Public sources:
- HaGeZi DoH/VPN/TOR/Proxy bypass, GPL-3.0-only
- UT1 vpn, CC-BY-SA-4.0

Social networks and short-video feeds. Id social, list 88.

Includes: Services whose main purpose is publishing to and following other users, and their media hosts.
Excludes: Messaging apps (see messaging), forums for a single topic, professional networking, the owners’ other products.
Public sources:
- StevenBlack social-only extension, MIT
- UT1 social_networks, CC-BY-SA-4.0
Services that also feed it: TikTok, Instagram, Facebook, Threads, Snapchat, X (Twitter), Reddit, Pinterest, Tumblr, BeReal

Online gaming

Online games, game stores and game networks. Id gaming, list 89.

Includes: Online games and their login, matchmaking and content hosts, game stores and console networks.
Excludes: Game news and reviews, educational games, esports results.
Public sources:
- UT1 games, CC-BY-SA-4.0
Services that also feed it: Roblox, Fortnite and Epic Games, Minecraft, Steam, Xbox network, PlayStation Network, Nintendo, Riot Games, Battle.net, HoYoverse

Video and music streaming

Video-on-demand, live streaming and music streaming services. Id streaming, list 90.

Includes: Subscription and free streaming platforms, live-streaming sites, their players and media CDNs.
Excludes: Broadcaster news sites, video conferencing, podcasts hosted by general-purpose hosts.
Public sources:
- UT1 audio-video, CC-BY-SA-4.0
Services that also feed it: YouTube, Netflix, Disney+, Prime Video, Hulu, HBO Max, Twitch, Kick, Spotify, SoundCloud, Crunchyroll

Messaging and chat

Instant messaging, chat rooms and voice chat. Id messaging, list 91.

Includes: Messaging apps, chat rooms and community voice chat, and their media hosts.
Excludes: Email, video conferencing for work and school, SMS.
Public sources:
- UT1 chat, CC-BY-SA-4.0
Services that also feed it: WhatsApp, Messenger, Telegram, Signal, Discord, WeChat

AI chatbots

General-purpose AI chat assistants and AI companion apps. Id ai, list 92.

Includes: Consumer chat front ends of AI assistants and AI companion or role-play apps.
Excludes: Developer APIs (for example api.openai.com) that other apps use, AI features built into search or office suites.
Public sources: none; curated in the repository only.
Curated domains: chat.deepseek.com, chat.mistral.ai, copilot.microsoft.com, grok.com, janitorai.com, meta.ai, poe.com, replika.ai, replika.com
Services that also feed it: ChatGPT, Claude, Gemini, Character.AI, Perplexity

Services

Each service blocks its own domains and every name under them. Under its name are the id a profile uses and the date of the last review. The What else stops working column is the collateral damage recorded when the service was reviewed; read it before blocking. desk review means the domains come from vendor documentation and public DNS observations; none has been verified on real devices yet.

Dating: services

Service	What else stops working	Domains
Tinder`tinder`desk review 2026-09-29	Other Match Group apps (Hinge, OkCupid, Match) are separate.	`gotinder.com` `tinder.com`
Bumble`bumble`desk review 2026-09-29	Also blocks Bumble For Friends, which uses the same account hosts.	`bumbcdn.com` `bumble.com`
Hinge`hinge`desk review 2026-09-29	Chat may go through a third-party messaging provider that is not blocked; profiles and matching fail.	`hinge.co` `hingeaws.net`
Grindr`grindr`desk review 2026-09-29	The app may use additional API hosts; verify on a device.	`grindr.com`

Service	What else stops working	Domains
TikTok`tiktok`desk review 2026-09-29	byteoversea.com, ibytedtos.com, ibyteimg.com and ipstatp.com are ByteDance infrastructure shared with CapCut and Lemon8, which degrade or stop too. TikTok embeds and share links on other sites stop working. The HaGeZi native TikTok tracker lists are separate blocklists.	`byteoversea.com` `ibytedtos.com` `ibyteimg.com` `ipstatp.com` `muscdn.com` `musical.ly` `tiktok.com` `tiktokcdn-us.com` `tiktokcdn.com` `tiktokv.com` `tiktokv.us` `tiktokw.us` `ttwstatic.com`
Instagram`instagram`desk review 2026-09-29	Some Instagram media is served from Meta’s shared fbcdn.net, which is only blocked by the Facebook service. Threads signs in with Instagram and may fail to log in when Instagram is blocked.	`cdninstagram.com` `ig.me` `instagr.am` `instagram.com`
Facebook`facebook`desk review 2026-09-29	fbcdn.net and facebook.net are Meta shared infrastructure: blocking them degrades Instagram, Threads, Messenger and WhatsApp (link previews, WhatsApp Web and some media) and Meta Quest headsets. “Log in with Facebook” and Facebook widgets on other sites stop working.	`facebook.com` `facebook.net` `fb.com` `fb.me` `fbcdn.net` `fbsbx.com`
Threads`threads`desk review 2026-09-29	Threads accounts are Instagram accounts; Instagram keeps working. Media is served from Meta CDNs shared with Instagram and Facebook.	`threads.com` `threads.net`
Snapchat`snapchat`desk review 2026-09-29	Also blocks Bitmoji and the Bitmoji keyboard, and “Log in with Snapchat” (Snap Kit) in other apps.	`bitmoji.com` `sc-cdn.net` `sc-static.net` `snap-dev.net` `snapchat.com` `snapkit.com`
X (Twitter)`x`desk review 2026-09-29	t.co wraps every link posted on X, so links shared from X in other apps stop opening. Embedded posts on other sites stop rendering.	`t.co` `twimg.com` `twitter.com` `x.com`
Reddit`reddit`desk review 2026-09-29	Search results that link to Reddit threads stop opening; embedded Reddit posts on other sites stop rendering.	`redd.it` `reddit.com` `redditmedia.com` `redditstatic.com`
Pinterest`pinterest`desk review 2026-09-29	Pinterest serves other country sites (pinterest.) that redirect to the listed ones; images saved on other sites from pinimg.com break.	`pin.it` `pinimg.com` `pinterest.ca` `pinterest.co.uk` `pinterest.com` `pinterest.com.au` `pinterest.de` `pinterest.fr`
Tumblr`tumblr`desk review 2026-09-29	Blogs on custom domains hosted by Tumblr are not blocked by name.	`tmblr.co` `tumblr.com`
BeReal`bereal`desk review 2026-09-29	Media may come from shared cloud storage hosts that are not blocked; the app fails without its API host.	`bere.al` `bereal.com`

Online gaming: services

Service	What else stops working	Domains
Roblox`roblox`desk review 2026-09-29	Blocks the game, Roblox Studio and the website.	`rbx.com` `rbxcdn.com` `roblox.com` `robloxlabs.com`
Fortnite and Epic Games`fortnite`desk review 2026-09-29	Fortnite signs in and matchmakes through Epic’s shared account and service hosts, so this also blocks the Epic Games Store, other Epic games (Rocket League, Fall Guys) and third-party games that use Epic Online Services (epicgames.dev) for accounts or cross-play.	`epicgames.com` `epicgames.dev` `fortnite.com`
Minecraft`minecraft`desk review 2026-09-29	Blocks sign-in, the Marketplace and Realms. Bedrock sign-in uses Xbox network hosts (see the Xbox service). Third-party servers are not blocked by name and a signed-in game may still reach them.	`minecraft.net` `minecraftservices.com` `mojang.com`
Steam`steam`desk review 2026-09-29	Also blocks game downloads and updates. Games already installed may still start in Steam offline mode. Steam Deck loses its store and updates.	`s.team` `steamcommunity.com` `steamcontent.com` `steamgames.com` `steampowered.com` `steamserver.net` `steamstatic.com` `steamusercontent.com`
Xbox network`xbox`desk review 2026-09-29	Xbox network sign-in is shared with PC Game Pass, the Xbox app on Windows and Minecraft Bedrock sign-in, which stop too. Microsoft account, Windows Update and Office are not blocked.	`xbox.com` `xboxlive.com` `xboxservices.com`
PlayStation Network`playstation`desk review 2026-09-29	Consoles also fetch system updates from playstation.net and cannot update while it is blocked. Offline play of installed games keeps working.	`playstation.com` `playstation.net` `sonyentertainmentnetwork.com`
Nintendo`nintendo`desk review 2026-09-29	The Switch checks connectivity against Nintendo hosts and reports no internet while they are blocked, which also stops system updates, the eShop and the parental-controls app sync. Offline play keeps working.	`nintendo.co.jp` `nintendo.com` `nintendo.net` `nintendowifi.net`
Riot Games`riot-games`desk review 2026-09-29	Blocks League of Legends, Valorant, Teamfight Tactics and the Riot client, which share one account and launcher.	`leagueoflegends.com` `playvalorant.com` `pvp.net` `riotcdn.net` `riotgames.com`
Battle.net`battle-net`desk review 2026-09-29	Blocks World of Warcraft, Overwatch, Diablo, Hearthstone and the PC versions of Call of Duty that sign in through Battle.net.	`battle.net` `blizzard.com`
HoYoverse`hoyoverse`desk review 2026-09-29	Blocks Genshin Impact, Honkai Star Rail and Zenless Zone Zero, which share HoYoverse accounts. Chinese-market servers use other hosts.	`hoyolab.com` `hoyoverse.com` `mihoyo.com`

Video and music streaming: services

Service	What else stops working	Domains
YouTube`youtube`desk review 2026-09-29	Also blocks YouTube Music, YouTube Kids and YouTube embeds on other sites. googlevideo.com also carries some Google Drive and Google Photos video playback. google.com and the shared googleapis.com and ggpht.com parents are not blocked. When this service is off, YouTube restricted mode still rewrites YouTube hosts.	`googlevideo.com` `youtu.be` `youtube-nocookie.com` `youtube.com` `youtube.googleapis.com` `youtubei.googleapis.com` `youtubekids.com` `yt3.ggpht.com` `ytimg.com`
Netflix`netflix`desk review 2026-09-29	Netflix games use the same account hosts and stop working too. Video is served by Open Connect caches under nflxvideo.net, including caches inside ISP networks, so blocking the names is effective.	`netflix.com` `netflix.net` `nflxext.com` `nflximg.com` `nflximg.net` `nflxso.net` `nflxvideo.net`
Disney+`disney-plus`desk review 2026-09-29	bamgrid.com, dssott.com and disneystreaming.com are Disney Streaming platform hosts shared with ESPN+ and Star+, which stop working too. disney.com and Disney’s other websites are not blocked.	`bamgrid.com` `disney-plus.net` `disneyplus.com` `disneystreaming.com` `dssott.com`
Prime Video`prime-video`desk review 2026-09-29	amazon.com is not blocked (shopping, Alexa and Kindle depend on it), so the Prime Video section of the Amazon shopping app and some Amazon-branded devices may still browse the catalogue; playback uses the blocked CDNs.	`aiv-cdn.net` `aiv-delivery.net` `amazonvideo.com` `primevideo.com` `pv-cdn.net`
Hulu`hulu`desk review 2026-09-29	Hulu content inside the Disney+ app is served through Disney+ hosts and is blocked by the Disney+ service, not this one.	`hulu.com` `huluim.com` `hulustream.com`
HBO Max`max`desk review 2026-09-29	hbo.com is HBO’s editorial site as well as the streaming service.	`hbo.com` `hbomax.com` `max.com`
Twitch`twitch`desk review 2026-09-29	Twitch embeds on other sites stop working. live-video.net (Amazon IVS, which also serves some Twitch video) is deliberately not blocked because other live-streaming sites use it; the Twitch player and chat fail without the listed hosts.	`ext-twitch.tv` `jtvnw.net` `ttvnw.net` `twitch.tv` `twitchcdn.net` `twitchsvc.net`
Kick`kick`desk review 2026-09-29	Kick video is delivered through Amazon IVS (live-video.net), which is not blocked because other sites share it; the site, app and chat fail.	`kick.com`
Spotify`spotify`desk review 2026-09-29	Also breaks Spotify Connect on speakers, TVs and cars on this network, and Spotify embeds and share links on other sites. Podcasts hosted elsewhere keep working in other podcast apps.	`pscdn.co` `scdn.co` `spoti.fi` `spotify.com` `spotify.link` `spotifycdn.com`
SoundCloud`soundcloud`desk review 2026-09-29	SoundCloud players embedded on other sites stop working.	`sndcdn.com` `soundcloud.com`
Crunchyroll`crunchyroll`desk review 2026-09-29	Video may be delivered through third-party CDNs that are not blocked; the app and site fail without crunchyroll.com.	`crunchyroll.com`

Messaging and chat: services

Service	What else stops working	Domains
WhatsApp`whatsapp`desk review 2026-09-29	Blocks messages, calls and media; WhatsApp Business uses the same hosts. WhatsApp does not depend on the Facebook service, but blocking Facebook degrades WhatsApp Web and link previews.	`wa.me` `whatsapp.com` `whatsapp.net`
Messenger`messenger`desk review 2026-09-29	The Messenger apps also use facebook.com hosts; to block Messenger completely, block the Facebook service too. Blocking only this service stops messenger.com and m.me links.	`m.me` `messenger.com`
Telegram`telegram`desk review 2026-09-29	The Telegram apps ship built-in server IP addresses and can connect without DNS once signed in, so a DNS block reliably stops the web client, links and new sign-ins but may not stop an installed app.	`t.me` `tdesktop.com` `telegra.ph` `telegram.me` `telegram.org` `telesco.pe`
Signal`signal`desk review 2026-09-29	Signal’s censorship circumvention and proxy support can bypass a DNS block when the user turns them on.	`signal.art` `signal.group` `signal.me` `signal.org` `whispersystems.org`
Discord`discord`desk review 2026-09-29	Games that use the Discord SDK for voice chat or rich presence lose those features. Images linked from Discord on other sites break.	`discord.co` `discord.com` `discord.gg` `discord.gift` `discord.media` `discord.new` `discordapp.com` `discordapp.net` `discordstatus.com`
WeChat`wechat`desk review 2026-09-29	Only WeChat hosts under qq.com are listed; QQ and other Tencent services keep working. WeChat Pay stops with WeChat.	`wechat.com` `weixin.qq.com` `wx.qq.com`

AI chatbots: services

Service	What else stops working	Domains
ChatGPT`chatgpt`desk review 2026-09-29	openai.com itself and api.openai.com are deliberately not blocked: other apps on the device may call the OpenAI API. Sign-in with the same account in other OpenAI products stops.	`auth.openai.com` `auth0.openai.com` `chat.openai.com` `chatgpt.com` `oaistatic.com` `oaiusercontent.com`
Claude`claude`desk review 2026-09-29	anthropic.com and api.anthropic.com are deliberately not blocked: other apps may call the API.	`claude.ai` `claude.com`
Gemini`gemini`desk review 2026-09-29	Only the Gemini web app is blocked. Gemini built into Android, Google Search, Gmail and Workspace uses shared Google hosts and cannot be blocked by name without breaking those products.	`bard.google.com` `gemini.google.com`
Character.AI`character-ai`desk review 2026-09-29	AI companion and role-play chat.	`c.ai` `character.ai`
Perplexity`perplexity`desk review 2026-09-29	Also blocks the Comet browser’s assistant features, which use the same hosts.	`perplexity.ai` `pplx.ai`

What is not built yet

Honest limits, so you can decide what DNS filtering can do for you:

No schedules or recreation time. A block applies all day. Schedules are planned.
No device verification yet. Every service was reviewed from vendor documentation and public DNS observations (desk review). Capturing each launch service on real iOS and Android devices is planned; it will add domains the apps use and mark them device-verified, one at a time.
Licences are not all cleared. Sources marked cloud only wait for a licence audit, which is planned. Until then self-hosted nodes do not get them.
Categories are best effort. Public category lists miss sites and include some they should not. Expect gaps, especially outside English.
DNS blocking can be bypassed. An app with built-in server addresses (Telegram, for example), a VPN, or a browser using its own encrypted DNS does not ask your resolver. The VPN, proxies and filter bypass category blocks many public DoH resolvers and VPN services, which helps but does not close every door.
One policy per profile. Different rules per child need separate profiles; per-device policies are not built.

See the comparison for how this compares with other filtering DNS services.