FAQ
Is Urlgate a full DNS blocker like Pi-hole?
Related idea, different shape. Blocking policy lives in Elixir with per-profile categories and allowlists. CoreDNS is only the recursive upstream — it does not own the blocklists.
Why did my check say allow for a known bad site?
The mega-list may still be seeding, or that host is not in the merged sources. Check
/api/v1/stats
(with API key) or the homepage list size. You can always add an
explicit block category via profile policy once the host is listed, or allowlist exceptions
the other way around.
Can kids still find porn via Google Images?
Not if SafeSearch is on — and it is on by default for every filter. Urlgate rewrites Google (including Images), Bing, DuckDuckGo, and YouTube at the DNS layer to their official safe / restricted endpoints. The child cannot turn that off in Chrome settings. You can disable it per filter for an adult device if you need to.
Is there a navigate API for WebViews?
Yes. Open default: POST /api/v1/navigate
with JSON body {"url":"…"}
returns {"url":"…"}
— the only URL the WebView should load (SafeSearch always on; block when mega-list
score > 6). Per-filter: /api/v1/navigate/<token>
uses the same token as Android / DoH, with that filter’s categories and SafeSearch
toggle (off = no YouTube/Google rewrite). No API key. See
docs
or the homepage Public APIs
samples.
Is there a public JSON API to check a domain?
Yes. GET /api/v1/lookup?url=…
(or POST
with JSON url
/ host) returns the same
mega-list verdict as the homepage checker — no API key, CORS enabled. The authenticated
POST /api/v1/check
remains for The Vig and private integrations. See
docs
and fair-use rules in the terms.
Can I block ads like Pi-hole?
Yes. Tick the ads
category on a filter — Urlgate merges HaGeZi / Blocklist Project / OISD ad lists and
sinkholes those domains over DNS (same idea as Pi-hole gravity). It is off by default on
new filters because ad lists are large and occasionally break a site; allowlist
exceptions still work. This is DNS-level blocking, not in-page cosmetic filtering.
How do phones use Urlgate DNS?
On Android, open Settings → Network → Private DNS, choose “Private DNS provider
hostname”, and enter the filter’s Android hostname (for example xxxxx.0xbase.eu). That uses DNS-over-TLS on port 853.
Other clients that accept a full URL can use the filter’s private DNS-over-HTTPS link
(/dns-query/…). On home Wi‑Fi, you can also point DHCP DNS at the Urlgate
host when UDP DNS is enabled.
Who can create filters?
Anyone with a valid email can request a magic link. After authenticator 2FA, you manage your own filters for phones and households. The public homepage never exposes private DNS links.
What happens if Urlgate is down for The Vig?
The Vig is designed to fail open to DeepSeek for classification if Urlgate errors. Child mode still benefits when Urlgate is healthy; outages should not hard-brick browsing via that path alone.
Can I turn off UDP DNS but keep the API?
Yes. Set URLGATE_DNS_ENABLED=false. HTTP check and DoH (when the HTTP
endpoint is up) remain available independently of the UDP listener.
Where do magic-link emails come from in development?
Dev uses the local Swoosh mailbox. Visit /dev/mailbox
when dev_routes
are enabled.
Is there a recovery code if I lose my authenticator?
Not yet. Treat 2FA setup carefully (backup the Base32 secret when enrolling). Server operators can clear TOTP fields in the database as a last resort.