Skip to main content
SPRby Supernetworks

DNS Block Lists & Settings

Block lists​

Manage Existing Blocklists:​

Next to each blocklist, click the three dots open a menu for additional actions you can take, such as:

  • Enable: Turn on a blocklist
  • Disable: To turn off the blocklist without deleting it.
  • Delete: To remove the blocklist entirely.

dns-block-lists-menu

Block Lists Tags​

It is also possible to apply a Tag to a blocklist. With tags set, the block list will only apply to devices that also have one of the tags assigned. Other devices are not affected by the block list

DNS Overrides​

Permit Override​

Permit overrides can be used to allow domains that are otherwise in a blocklist. The rule can be device specific, by assigning a Client IP, or it can be global.

The rule can also have an expiration assigned for the rule to expire.

Lastly, the permit rule can have an IP address to override a DNS response with an IP address

dns-override

Block Override​

A block override can also be used to create a rule to block a domain. The Result IP is ignored for a block rule.

Settings​

The DNS Settings can be used to set Client IPs or Domains to keep out of the DNS Logs

dns-block-lists-menu

Core DNS Settings​

The Core DNS Settings screen controls which upstream resolvers SPR forwards queries to, and whether those queries are encrypted. Settings are saved through the /dnsSettings endpoint.

Upstream DNS Providers​

By default a single upstream provider is configured, chosen from presets such as Cloudflare (1.1.1.1), Quad9 (9.9.9.9), or Google (8.8.8.8). You can also type any resolver IP address directly.

Enable Use Multiple Providers to configure a list of upstream providers instead of a single one. Providers are tried in order, giving you fallback if the first resolver is unreachable. Use Add Provider to append an entry and the trash icon to remove one. Each provider has its own IP address, DNS hostname, and TLS setting.

DNS over TLS (DoT)​

Each provider can encrypt outbound DNS queries using DNS over TLS. When TLS is enabled for a provider, SPR forwards to it as a tls:// upstream and validates the certificate against the DNS Hostname you set (for example cloudflare-dns.com for 1.1.1.1, or dns.quad9.net for 9.9.9.9). The preset resolvers auto-fill the matching hostname.

Leave TLS enabled to keep queries private. If you disable TLS for a provider, leave the hostname blank — SPR forwards to the plain IP address and rejects a TLS hostname when TLS is off.

Family (Family-Safe) Providers​

A separate set of Family Filter providers can be configured for family-safe resolution. These default to filtering resolvers such as Cloudflare Family (1.1.1.3) or OpenDNS Family (208.67.222.123), and support the same multiple provider and DNS over TLS options as the primary list.

The family resolvers are only used for devices assigned the dns:family policy. Assign this policy to a device (from its device settings, personas, or a bulk edit) and that device's DNS queries are routed to the family providers, while everything else continues to use the primary providers. If no family provider is configured, SPR falls back to Cloudflare Family (1.1.1.3).

Captive-Portal Domains​

When you connect SPR behind another network's captive portal (for example hotel or airport Wi-Fi), you can allow specific domains to resolve through that network's DHCP-provided DNS so the portal can load. On an Uplink interface, enable captive portal passthrough and list the domains to bypass. SPR then forwards only those domains to the upstream DNS learned over DHCP.

DHCP-Learned Upstreams​

When SPR's own uplink obtains its address over DHCP, it learns the upstream DNS servers advertised by that network. These learned resolvers are used to resolve the captive-portal domains described above.

Logs​

The DNS Log View can be used to inspect dns requests. Use the buttons on the right to quickly add a permit or deny override rule.

dns-block-lists-menu