Integrate MN Risk threat feeds with Pi-hole
Pi-hole filters DNS names. Use only the MN Risk domain block feed:
https://feeds.mnrisk.net/global/block/domains.txt
global/detect/domains.txt either. Pi-hole treats domains from a subscribed list as block entries and does not provide a monitor-only action for that list.Use a sector feed instead
A bank can use the Finance domain block feed instead of the broader global domain feed:
https://feeds.mnrisk.net/sectors/finance/block/domains.txt
Choose either the sector domain feed or the global domain feed. Adding both is unnecessary because the global feed already contains the sector-attributed entries.
Browse available sectors and current feed counts.
Before you begin
- Confirm Pi-hole is the DNS resolver used by the clients you want to protect.
- Confirm the Pi-hole host or container can resolve
feeds.mnrisk.netand connect to it over HTTPS. - Plan a staged rollout if Pi-hole serves business-critical systems. Pi-hole groups can limit the feed to test clients first.
Add the domain feed
- Sign in to the Pi-hole web interface.
- Open the subscribed-list page. Depending on the Pi-hole version, it is labeled Lists or Group Management > Adlists.
- Add
https://feeds.mnrisk.net/global/block/domains.txtas the list address. - Use
MN Risk domain block feedas the comment or description. - Assign the list to the intended group. New lists normally use the Default group unless you change the assignment.
- Save the list.
- Open Tools > Update Gravity, or run the command below on the Pi-hole host.
sudo pihole updateGravity
The shorter sudo pihole -g command performs the same gravity update.
For a Docker installation, replace pihole with the actual container name if needed:
docker exec -it pihole pihole updateGravity
Gravity retrieves subscribed lists, removes duplicates, updates Pi-hole's gravity database, and reloads DNS blocking. Pi-hole also runs gravity automatically on its normal update schedule.
Verify the integration
- Confirm the gravity update reports a successful download from
feeds.mnrisk.net. - Copy one domain from the feed and query Pi-hole's local lists without browsing to the domain:
pihole query domain.example
Replace domain.example with an actual entry from the feed.
- Confirm the result identifies the MN Risk subscribed list.
- Review Pi-hole's Query Log after rollout to confirm that listed domains are being blocked for the intended clients.
Handle a false positive
Add a confirmed false positive to Pi-hole's local allowlist:
sudo pihole allow domain.example
You can also add the domain through the Pi-hole web interface. Record why the exception was made and review it periodically. A local allow entry lets you restore access without removing the entire MN Risk feed.
Disable or remove the feed
- Disable or delete the MN Risk entry from the subscribed-list page.
- Run
sudo pihole updateGravityagain. - Confirm the MN Risk list no longer appears in
pihole queryresults.