# Block types

When GraceDNS blocks a lookup, you choose what the asking device sees. The right choice depends on who the block is for: a user you want to inform, software you want to fail quietly, or a system you want to give a machine-readable reason. Set a default per configuration and override it per rule or per list.

## Zero answer (default)

**Invisible and quiet.** The lookup succeeds but returns the unusable address 0.0.0.0, so the connection dies instantly on the device itself. No error page, no retry storms, nothing to explain. This is the right default for ad-style blocking and for devices nobody is watching.

## Not found (NXDOMAIN)

**The domain appears not to exist.** Indistinguishable from a typo, which some software handles more gracefully than an unreachable address. Choose it when you want blocked domains to look simply absent.

## Refused with a reason

**Honest and machine-readable.** The lookup is refused outright and the response carries a standardized extended error (Blocked, code 17) naming the category that matched, such as the threat list or "custom". Modern operating systems and diagnostic tools surface it, so this is the right choice for administrators who want "why was this blocked" answerable from the client side.

## Block page

**Visible to the user.** The lookup answers with the address of a block page, so plain HTTP visits show a page explaining the block instead of a spinner. Best for parental and workplace filtering where you want people to understand what happened.

**The honest limitation:** most sites use HTTPS, and the browser will show a certificate warning before the block page for those, because we cannot and should not impersonate the blocked site. That warning is your device's security working correctly; it just makes the block page most useful for the shrinking share of plain HTTP traffic. Details in [what DNS filtering cannot do](../limitations.md).

Back to [features](index.md).