PlayStation Network and update blocklist

This is a strict, fail-closed DNS blocklist for jailbroken PS5 and PS4 consoles. It intentionally blocks firmware checks and downloads, game/app updates, PlayStation Network authentication, the Store, console telemetry, and most other Sony-hosted console services.

There are two lists. Run the main list everywhere and layer the strict list on the console:

List	Blocks	Use when
blocklist.txt	PSN, firmware and game/app updates, Store, telemetry	Any jailbroken PS4/PS5
blocklist-strict.txt	Everything above, plus YouTube and Google/Cobalt update endpoints	A PS5 using Y2JB, or any console that should not reach YouTube

https://git.richey.dev/miles/psn-blocklist/raw/branch/main/blocklist.txt
https://git.richey.dev/miles/psn-blocklist/raw/branch/main/blocklist-strict.txt

The strict list is a generated superset of the main list, so subscribing to both is redundant but harmless.

Use the /raw/ URL above. The /src/ URL is an HTML repository page and is not an appropriate Pi-hole subscription URL.

Why this list uses two formats

blocklist.txt contains both:

• Pi-hole 6 ABP suffix entries such as ||playstation.net^. These match the base name and every subdomain, including future regional update names.
• Plain exact domains for older Pi-hole releases and other gravity-style DNS filters.

A list containing only playstation.net does not wildcard-match fus01.ps5.update.playstation.net as a normal exact gravity entry. The ABP suffix entries are therefore the primary protection on Pi-hole 6.

Pi-hole setup

The recommended layout is:

Pi-hole group	Members	Lists
Default	Every LAN client	blocklist.txt
Console group, e.g. PlayStation	Each jailbroken console	blocklist-strict.txt

Putting blocklist.txt on Default means any PlayStation device, including one that is unregistered, factory reset, or has picked up a new DHCP address, cannot reach PSN or update servers. The cost is that PlayStation websites and apps (the PlayStation App, playstation.com, PS Remote Play over the internet) stop working on every device in Default. Clients you exclude from Default, such as a "No Block" group, are not protected.

blocklist-strict.txt additionally breaks YouTube, so assign it only to the console group. Add the console to both Default and the console group if it should also keep your ordinary ad lists; the overlap with blocklist.txt is harmless.

Pi-hole picks one client entry per query, trying an exact IP match first, then a CIDR subnet, then a MAC address. If a subnet client such as 192.168.0.0/24 already exists, a console added by MAC never matches; add it by its reserved IP address instead. If the console's address changes, it falls back to the subnet entry and loses the strict rules while keeping blocklist.txt, so reserve its IP in DHCP.

After adding the raw URL as a blocked subscription, update gravity:

pihole -g

Representative checks from another LAN machine are:

dig @PIHOLE_IP fus01.ps5.update.playstation.net A +short
dig @PIHOLE_IP dus01.ps5.update.playstation.net A +short
dig @PIHOLE_IP made-up-region.ps5.update.playstation.net A +short
dig @PIHOLE_IP auth.api.sonyentertainmentnetwork.com A +short

Depending on Pi-hole's blocking mode, each should return 0.0.0.0, NODATA, or NXDOMAIN. The invented hostname is useful because it proves the suffix rule is working rather than merely finding an exact hostname in the list.

Y2JB and the strict list

Y2JB persists as a poisoned Cobalt splash-screen cache keyed on https://www.youtube.com/tv. If www.youtube.com resolves, the YouTube app loads the real page, which kills the exploit and can re-cache YouTube's genuine splash screen over the payload. The main list deliberately does not block YouTube, so a Y2JB console needs blocklist-strict.txt.

The YouTube app package is updated through Sony's title-patch servers, which both lists already block. The strict list adds the YouTube web/API/video namespaces and Cobalt's Evergreen updater and Google download hosts, so an updated Cobalt build that Y2JB rejects cannot be fetched either.

After switching lists, run pihole -g (it also flushes the DNS cache) and confirm from the console's address:

dig @PIHOLE_IP www.youtube.com A +short

If the real YouTube page already loaded once, the cached payload may already be replaced. Reinstall Y2JB's download0.dat after the strict list is in place; blocking DNS afterwards does not restore it.

User Guide redirect

The goal is to serve the User Guide from your own host. The strict suffix rule ||playstation.net^ blocks manuals.playstation.net, so the console needs both an allow rule and a local answer. Both parts are required: the allow rule alone sends the console to Sony, and the Local DNS record alone is still blocked.

The allow rule cannot be inlined into blocklist.txt. Pi-hole parses a block-type adlist into the gravity table, and there a line beginning with @ fails both the ABP-syntax check and domain validation, so it is discarded as an invalid entry. It must come from an allow-type source.

On Pi-hole 6:

1. Add this URL as an allowed subscription and assign it to the same console group as blocklist.txt:

   https://git.richey.dev/miles/psn-blocklist/raw/branch/main/allowlist-user-guide.txt
   

   A single Pi-hole with no need to version the exception can instead run pihole allow manuals.playstation.net. Allow rules are evaluated ahead of gravity either way, so the exception wins over the suffix block.

2. Add a Local DNS record for manuals.playstation.net pointing at the desired web server.

3. Run pihole -g and flush/restart DNS if the old blocked answer is cached.

Confirm the console gets your host rather than 0.0.0.0 or Sony's address:

dig @PIHOLE_IP manuals.playstation.net A +short

With nanoDNS, keep the exact manuals.playstation.net=<IP> override before its *.playstation.net=0.0.0.0 rule. The exact nanoDNS override prevents that query from reaching Pi-hole, so the Pi-hole allow subscription is mainly needed when the console queries Pi-hole directly.

Welcome Hub content

The Welcome Hub needs its content API even when PSN authentication and system updates remain blocked. On Pi-hole 6, add this URL as an allowed subscription and assign it to the same console group as blocklist.txt:

https://git.richey.dev/miles/psn-blocklist/raw/branch/main/allowlist-welcomehub.txt

The subscription allows exactly three domains:

• asm.np.community.playstation.net, which the native NP manager contacts during initialization.
• ps5.np.playstation.net, which serves the Welcome Hub content API.
• feature-discovery-assets-amd.dl.playstation.net, which serves its backgrounds and other feature-discovery media.

Run pihole -g after adding the subscription. Keep authentication, firmware update, and other PlayStation domains blocked; allowing all of playstation.net is neither necessary nor recommended.

Console-side and network safeguards

• Do not configure a public secondary DNS server. Clients may use it instead of the primary server; it is not merely a standby.
• Cover IPv6 too. Advertise Pi-hole as the LAN IPv6 resolver, configure nanoDNS on ::1, or disable IPv6 for the console network. An automatic IPv6 resolver can bypass an IPv4-only block.
• Disable automatic system-software and game/app downloads in the console UI.
• Delete any already-downloaded update from Downloads/Notifications. DNS blocking cannot remove a cached PUP or stop its installation.
• For the strongest protection, enforce the console's resolver at the router or firewall: deny outbound TCP/UDP 53 and TCP 853 except to Pi-hole. A fully offline console or an allowlisted egress VLAN is stronger than any DNS list.

If the PS5 uses nanoDNS at 127.0.0.1, failure to start nanoDNS is normally fail-closed: DNS stops working. If the console network settings revert to Automatic, only router-side DNS/firewall enforcement remains.

Expected breakage

Both lists block PSN sign-in, the Store, title metadata, game/app updates, cloud features, internet Remote Play discovery/STUN, telemetry, and the official User Guide unless explicitly allowed and redirected. LAN Remote Play by direct console IP may still work. The strict list additionally breaks the YouTube app and any YouTube embeds on homebrew pages.

DNS blocking is defense in depth, not an absolute guarantee. It cannot block a hard-coded destination IP, an alternate resolver, traffic already in cache, or a future endpoint outside every covered Sony namespace. See SOURCES.md for the evidence and exclusion policy.