Vessel

DNS filtering

When you create a device you can have Vessel's DNS block malicious sites and ads. By default nothing is filtered.

Check the current filter

Press the button on a device connected to Vessel. The page connects to four test addresses on anoni.net; Vessel's resolvers hide some of them, and which ones go through shows the filter in effect.

The test addresses go through Cloudflare to anoni.net's servers, which keep no record of these connections.

To also check that your traffic goes through a Vessel node, use the Connection check.

The three options

No filtering

Domains are looked up and nothing is blocked.

Block malware

Uses HaGeZi's Threat Intelligence Feeds (mini) to block about 425,000 domains that spread malware, phishing, scams and cryptomining, with few false positives.

Block malware and ads

Adds HaGeZi Multi (Normal), about 341,000 domains for ads, tracking, analytics and telemetry. It sometimes breaks part of an ordinary site.

How it works

Before a device connects to a site, it asks the resolver on the Vessel node for the domain. Domains on the list get a “no such domain” answer, so the connection never starts. The lists are updated every 8 hours and published on HaGeZi's GitHub.

The resolvers keep no record of queries or of what they block. The blocked count in your device list is a per-device tally on the node, a number with no names. The resolvers also validate DNSSEC and reject answers with bad signatures.

What it cannot do

  • Ads served from the same domain as the content, such as ads in YouTube videos
  • Main domains of common services such as Facebook and YouTube, which the list leaves alone so sites keep working
  • Queries from browsers whose “secure DNS” is set to another provider, or from apps that pick their own DNS, do not reach Vessel's resolvers (Firefox turns off the secure DNS it enables by default, so that case still works)
  • It sees only domains, not the path of a URL or the contents of HTTPS connections
  • It does not replace antivirus software, and it can block an ordinary site

Changing it and reporting mistakes

The filter is chosen when a device is created. To change it, delete the device and create it again. If an ordinary site is blocked, report it on the list's GitHub; the fix applies once the list is updated.