# protect.txt — domains that must NEVER be blocked, whatever a source says.
#
# One domain per line; "#" starts a comment. A domain here protects itself
# and its parents: if a list holds the name or a parent of it (blocking
# "microsoft.com" would block "update.microsoft.com"), the build removes
# that entry and prints it (PROTECTED in the log, "protected_removed" in
# manifest.json). Its subdomains can still be listed: protect each name
# that matters.
#
# Keep it to the infrastructure that breaks devices when blocked: search
# engines, operating system updates, time servers, captive-portal and
# connectivity checks, certificate checks, and the domains of Warda.
# Not the public encrypted DNS services: the category bypass must keep
# them (Warda reaches its upstreams by address).

# Warda: every name of the tunnel of Warda (warda-terraform-cloudflare).
# The names of the boxes (<10 letters>.warda-dns.net) are subdomains, not
# protected here: allow.txt keeps them out of every list.
warda-dns.com
www.warda-dns.com
cloud.warda-dns.com
docs.warda-dns.com
support.warda-dns.com
bimi.warda-dns.com
warda-dns.net
warda-dns.fr
warda-dns.eu
tips-of-mine.com
gitea.tips-of-mine.com

# Search engines
google.com
www.google.com
bing.com
www.bing.com
duckduckgo.com
qwant.com
www.qwant.com
www.ecosia.org
search.brave.com

# Microsoft: updates, time, connectivity check, sign-in
update.microsoft.com
windowsupdate.com
download.windowsupdate.com
ctldl.windowsupdate.com
delivery.mp.microsoft.com
time.windows.com
www.msftconnecttest.com
www.msftncsi.com
dns.msftncsi.com
login.microsoftonline.com
login.live.com

# Apple: updates, time, captive portal, sign-in, certificates
captive.apple.com
time.apple.com
time-ios.apple.com
mesu.apple.com
swscan.apple.com
swdist.apple.com
updates.cdn-apple.com
appldnld.apple.com
gs.apple.com
ocsp.apple.com
appleid.apple.com

# Google / Android: connectivity check, time, updates
connectivitycheck.gstatic.com
connectivitycheck.android.com
clients3.google.com
www.gstatic.com
time.android.com
time.google.com
android.clients.google.com
play.googleapis.com

# Linux: updates, connectivity checks
deb.debian.org
security.debian.org
archive.ubuntu.com
security.ubuntu.com
connectivity-check.ubuntu.com
nmcheck.gnome.org
detectportal.firefox.com
network-test.debian.org
dl.fedoraproject.org
mirrors.fedoraproject.org

# Time servers (NTP)
pool.ntp.org
0.pool.ntp.org
1.pool.ntp.org
2.pool.ntp.org
3.pool.ntp.org
fr.pool.ntp.org
time.cloudflare.com

# Certificate checks (OCSP, revocation)
ocsp.digicert.com
crl3.digicert.com
ocsp.pki.goog
ocsp.sectigo.com
ocsp.globalsign.com
