PlayStation Network and update blocklist

This is a strict, fail-closed DNS blocklist for jailbroken PS5 and PS4 consoles. It intentionally blocks firmware checks and downloads, game/app updates, PlayStation Network authentication, the Store, console telemetry, and most other Sony-hosted console services.

The main list is:

https://git.richey.dev/miles/psn-blocklist/raw/branch/main/blocklist.txt

Use the /raw/ URL above. The /src/ URL is an HTML repository page and is not an appropriate Pi-hole subscription URL.

Why this list uses two formats

blocklist.txt contains both:

• Pi-hole 6 ABP suffix entries such as ||playstation.net^. These match the base name and every subdomain, including future regional update names.
• Plain exact domains for older Pi-hole releases and other gravity-style DNS filters.

A list containing only playstation.net does not wildcard-match fus01.ps5.update.playstation.net as a normal exact gravity entry. The ABP suffix entries are therefore the primary protection on Pi-hole 6.

Pi-hole setup

Create a dedicated group such as Jailbroken PlayStation, add each console by its reserved IP address or MAC address, and assign this adlist only to that group. Do not assign this strict list to ordinary phones, PCs, or a whole LAN unless breaking all PlayStation sites and applications there is intentional.

After adding the raw URL as a blocked subscription, update gravity:

pihole -g

Representative checks from another LAN machine are:

dig @PIHOLE_IP fus01.ps5.update.playstation.net A +short
dig @PIHOLE_IP dus01.ps5.update.playstation.net A +short
dig @PIHOLE_IP made-up-region.ps5.update.playstation.net A +short
dig @PIHOLE_IP auth.api.sonyentertainmentnetwork.com A +short

Depending on Pi-hole's blocking mode, each should return 0.0.0.0, NODATA, or NXDOMAIN. The invented hostname is useful because it proves the suffix rule is working rather than merely finding an exact hostname in the list.

User Guide redirect

The strict suffix rule also blocks manuals.playstation.net. To use a local User Guide redirect on Pi-hole 6:

1. Add this URL as an allowed subscription and assign it to the same console group:

   https://git.richey.dev/miles/psn-blocklist/raw/branch/main/allowlist-user-guide.txt
   

2. Add a Local DNS record for manuals.playstation.net pointing at the desired web server.

3. Run pihole -g and flush/restart DNS if the old blocked answer is cached.

With nanoDNS, keep the exact manuals.playstation.net=<IP> override before its *.playstation.net=0.0.0.0 rule. The exact nanoDNS override prevents that query from reaching Pi-hole, so the Pi-hole allow subscription is mainly needed when the console queries Pi-hole directly.

Console-side and network safeguards

• Do not configure a public secondary DNS server. Clients may use it instead of the primary server; it is not merely a standby.
• Cover IPv6 too. Advertise Pi-hole as the LAN IPv6 resolver, configure nanoDNS on ::1, or disable IPv6 for the console network. An automatic IPv6 resolver can bypass an IPv4-only block.
• Disable automatic system-software and game/app downloads in the console UI.
• Delete any already-downloaded update from Downloads/Notifications. DNS blocking cannot remove a cached PUP or stop its installation.
• For the strongest protection, enforce the console's resolver at the router or firewall: deny outbound TCP/UDP 53 and TCP 853 except to Pi-hole. A fully offline console or an allowlisted egress VLAN is stronger than any DNS list.

If the PS5 uses nanoDNS at 127.0.0.1, failure to start nanoDNS is normally fail-closed: DNS stops working. If the console network settings revert to Automatic, only router-side DNS/firewall enforcement remains.

Expected breakage

This strict profile blocks PSN sign-in, the Store, title metadata, game/app updates, cloud features, internet Remote Play discovery/STUN, telemetry, and the official User Guide unless explicitly allowed and redirected. LAN Remote Play by direct console IP may still work.

DNS blocking is defense in depth, not an absolute guarantee. It cannot block a hard-coded destination IP, an alternate resolver, traffic already in cache, or a future endpoint outside every covered Sony namespace. See SOURCES.md for the evidence and exclusion policy.