Back to documentation

Integrate MN Risk threat feeds with Pi-hole

Pi-hole filters DNS names. Use only the MN Risk domain block feed:

https://feeds.mnrisk.net/global/block/domains.txt
Do not add the IP, CIDR, IPv6, URL, or SHA-256 feeds to Pi-hole. Those values are not Pi-hole domain-list entries. Do not add global/detect/domains.txt either. Pi-hole treats domains from a subscribed list as block entries and does not provide a monitor-only action for that list.

Use a sector feed instead

A bank can use the Finance domain block feed instead of the broader global domain feed:

https://feeds.mnrisk.net/sectors/finance/block/domains.txt

Choose either the sector domain feed or the global domain feed. Adding both is unnecessary because the global feed already contains the sector-attributed entries.

Browse available sectors and current feed counts.

Before you begin

Add the domain feed

  1. Sign in to the Pi-hole web interface.
  2. Open the subscribed-list page. Depending on the Pi-hole version, it is labeled Lists or Group Management > Adlists.
  3. Add https://feeds.mnrisk.net/global/block/domains.txt as the list address.
  4. Use MN Risk domain block feed as the comment or description.
  5. Assign the list to the intended group. New lists normally use the Default group unless you change the assignment.
  6. Save the list.
  7. Open Tools > Update Gravity, or run the command below on the Pi-hole host.
sudo pihole updateGravity

The shorter sudo pihole -g command performs the same gravity update.

For a Docker installation, replace pihole with the actual container name if needed:

docker exec -it pihole pihole updateGravity

Gravity retrieves subscribed lists, removes duplicates, updates Pi-hole's gravity database, and reloads DNS blocking. Pi-hole also runs gravity automatically on its normal update schedule.

Verify the integration

  1. Confirm the gravity update reports a successful download from feeds.mnrisk.net.
  2. Copy one domain from the feed and query Pi-hole's local lists without browsing to the domain:
pihole query domain.example

Replace domain.example with an actual entry from the feed.

  1. Confirm the result identifies the MN Risk subscribed list.
  2. Review Pi-hole's Query Log after rollout to confirm that listed domains are being blocked for the intended clients.

Handle a false positive

Add a confirmed false positive to Pi-hole's local allowlist:

sudo pihole allow domain.example

You can also add the domain through the Pi-hole web interface. Record why the exception was made and review it periodically. A local allow entry lets you restore access without removing the entire MN Risk feed.

Disable or remove the feed

  1. Disable or delete the MN Risk entry from the subscribed-list page.
  2. Run sudo pihole updateGravity again.
  3. Confirm the MN Risk list no longer appears in pihole query results.

Pi-hole references