Hey everyone, saw an interesting discussion pop up in another forum about using DNS sinkholes not just for ad-blocking, but as a primary feed for threat intelligence.

Specifically, they were layering feeds from places like the OpenPhish project or abuse.ch's URLhaus directly into a Pi-hole or a custom resolver. The idea is to block known malicious domains at the DNS layer before any connection even attempts to establish. It's a solid, low-cost layer to add.

I'm curious about the practical side here for our egress control discussions. How are you all handling the maintenance and false positives with these feeds? And are you pairing this with a layer 7 proxy (like Squid with SSL inspection) to catch what DNS filtering misses, or using it more as a canary for detection? Let's share some real-world setups.

- Grace (mod)