Block AI Tools at the DNS Layer —
Network-Wide, Zero Client Config

# Step 0: Generate the plain domain list from the API CSV
# (run daily via cron; serve the file from an internal web server)
curl -s -H "X-API-Key: YOUR_API_KEY" \
  "https://www.aitoolsblocklist.com/api/database/?action=download_database" \
  | tail -n +2 | cut -d, -f1 > /var/www/html/ai_domains.txt

# Step 1: Add the internally hosted list URL as a new adlist
sqlite3 /etc/pihole/gravity.db \
  "INSERT INTO adlist (address, enabled, comment) VALUES \
  ('http://lists.yourcompany.internal/ai_domains.txt', 1, 'AI Tools Blocklist - 17,410+ domains');"

# Step 2: Update gravity to download and compile the new list
pihole -g

# Step 3: Verify the domains were loaded
pihole -g -l   # Shows number of domains per list

# Alternative: Add via the Pi-hole web admin
# Navigate to: Group Management → Adlists → Paste URL → Add → Tools → Update Gravity

# Create a group and assign the AI blocklist to it
sqlite3 /etc/pihole/gravity.db "INSERT INTO 'group' (name, enabled, description) \
  VALUES ('ai-blocked', 1, 'Users blocked from AI tools');"

# Get the group ID (e.g., 2) and the adlist ID for the AI blocklist
sqlite3 /etc/pihole/gravity.db "SELECT id FROM 'group' WHERE name='ai-blocked';"
sqlite3 /etc/pihole/gravity.db "SELECT id FROM adlist WHERE comment LIKE '%AI Tools%';"

# Link the adlist to the group (replace IDs as needed)
sqlite3 /etc/pihole/gravity.db \
  "INSERT INTO adlist_by_group (adlist_id, group_id) VALUES (3, 2);"

# Assign a client to the group (by IP address)
sqlite3 /etc/pihole/gravity.db \
  "INSERT INTO client (ip, comment) VALUES ('192.168.1.100', 'Marketing workstation');"

pihole restartdns

# /etc/unbound/unbound.conf — add include directive for AI blocklist
server:
    # ... your existing server configuration ...
    verbosity: 1
    interface: 0.0.0.0
    access-control: 10.0.0.0/8 allow
    access-control: 192.168.0.0/16 allow

    # Include the AI tools blocklist
    include: "/etc/unbound/ai-blocklist.conf"

# /etc/unbound/ai-blocklist.conf — generated from AI Tools Blocklist feed
# Each domain gets two directives: a local-zone and a local-data record
local-zone: "openai.com." redirect
local-data: "openai.com. A 0.0.0.0"

local-zone: "chat.openai.com." redirect
local-data: "chat.openai.com. A 0.0.0.0"

local-zone: "claude.ai." redirect
local-data: "claude.ai. A 0.0.0.0"

local-zone: "anthropic.com." redirect
local-data: "anthropic.com. A 0.0.0.0"

local-zone: "midjourney.com." redirect
local-data: "midjourney.com. A 0.0.0.0"

# ... 17,410+ domains total

# /etc/dnsmasq.conf — include AI blocklist directory
# Add this line to your main dnsmasq configuration
conf-dir=/etc/dnsmasq.d/,*.conf

# /etc/dnsmasq.d/ai-blocklist.conf — generated from AI Tools Blocklist
# Each address= directive blocks the domain and all subdomains
address=/openai.com/0.0.0.0
address=/claude.ai/0.0.0.0
address=/anthropic.com/0.0.0.0
address=/midjourney.com/0.0.0.0
address=/gemini.google.com/0.0.0.0
address=/jasper.ai/0.0.0.0
address=/copy.ai/0.0.0.0
address=/writesonic.com/0.0.0.0
address=/replika.com/0.0.0.0
address=/character.ai/0.0.0.0
# ... 17,410+ domains total

# Optional: log blocked queries for monitoring
log-queries
log-facility=/var/log/dnsmasq-blocked.log

#!/bin/bash
# /usr/local/bin/update-ai-blocklist.sh
# Daily update script for DNS-based AI domain blocking
# Supports Unbound, BIND RPZ, and dnsmasq

API_KEY="YOUR_API_KEY"
API_URL="https://www.aitoolsblocklist.com/api/database/?action=download_database"
LOG="/var/log/ai-blocklist-update.log"
DATE=$(date +"%Y-%m-%d %H:%M:%S")

echo "[$DATE] Starting AI blocklist update" >> "$LOG"

# Detect which resolver is running
if systemctl is-active --quiet unbound; then
    FORMAT="unbound"
    DEST="/etc/unbound/ai-blocklist.conf"
    RELOAD="systemctl reload unbound"
elif systemctl is-active --quiet named; then
    FORMAT="rpz"
    DEST="/etc/bind/zones/ai-tools.rpz.db"
    RELOAD="rndc reload ai-tools.rpz"
elif systemctl is-active --quiet dnsmasq; then
    FORMAT="dnsmasq"
    DEST="/etc/dnsmasq.d/ai-blocklist.conf"
    RELOAD="systemctl restart dnsmasq"
else
    echo "[$DATE] ERROR: No supported resolver detected" >> "$LOG"
    exit 1
fi

# Download the latest database CSV (domain,category,subcategory)
CSV=$(mktemp)
TEMP=$(mktemp)
HTTP_CODE=$(curl -s -w "%{http_code}" -o "$CSV" \
  -H "X-API-Key: ${API_KEY}" "$API_URL")

if [ "$HTTP_CODE" -eq 200 ]; then
    # Convert the CSV's domain column to the resolver's native format
    case "$FORMAT" in
        unbound)
            awk -F, 'NR>1 {print "local-zone: \"" $1 "\" always_nxdomain"}' "$CSV" > "$TEMP" ;;
        rpz)
            # rpz-header.db holds the SOA/NS boilerplate — bump its serial first
            cat /etc/bind/zones/rpz-header.db > "$TEMP"
            awk -F, 'NR>1 {print $1 " CNAME .\n*." $1 " CNAME ."}' "$CSV" >> "$TEMP" ;;
        dnsmasq)
            awk -F, 'NR>1 {print "address=/" $1 "/0.0.0.0"}' "$CSV" > "$TEMP" ;;
    esac
    rm -f "$CSV"
    COUNT=$(wc -l < "$TEMP")
    mv "$TEMP" "$DEST"
    chmod 644 "$DEST"
    eval "$RELOAD"
    echo "[$DATE] SUCCESS: Updated $DEST with $COUNT entries, reloaded $FORMAT" >> "$LOG"
else
    rm -f "$TEMP" "$CSV"
    echo "[$DATE] ERROR: Download failed with HTTP $HTTP_CODE" >> "$LOG"
    exit 1
fi

# Add to crontab: run daily at 3:00 AM
0 3 * * * /usr/local/bin/update-ai-blocklist.sh

# Make the script executable
chmod +x /usr/local/bin/update-ai-blocklist.sh

# Test the script manually before enabling the cron job
sudo /usr/local/bin/update-ai-blocklist.sh
tail -5 /var/log/ai-blocklist-update.log