Global Domain Blocklist
The Domain Blocklist publishes an immutable, tenant-wide desired set of blocked domains.
The Domain Blocklist publishes an immutable, tenant-wide desired set of blocked domains. It is
durable policy, unlike a per-device Active Response BlockDomain action.
Catalogues and versions
Section titled “Catalogues and versions”| Concept | Meaning |
|---|---|
| Catalogue | A named set of domains |
| Blocklist version | An immutable snapshot of selected catalogues |
| Resolved domains | The materialized domain set for that version |
| Rollout status | Per-device applied/pending/stale/failed/unconfirmed/unsupported state |
Publishing a blocklist:
- Select catalogues.
- Preview the result.
- Publish. UEC creates
version + 1, snapshots each catalogue hash and materialises resolved domains. - The previous active version is superseded.
- Online agents are pushed to pull the active version.
- Heartbeat hints converge offline/new devices.
- Applied version is reported back.
Editing a catalogue after publication does not silently mutate the live blocklist. The UI shows
drift (unchanged or modified, with added/removed domains); you must publish a new version.
Device rollout states
Section titled “Device rollout states”| Status | Meaning |
|---|---|
| Applied | Device reports the active version |
| Pending | Expected to converge |
| Stale | Device reports an old version |
| Failed | Endpoint application failed |
| Unconfirmed | No reliable applied-version report yet |
| Unsupported | Agent/platform cannot enforce GBD |
Each status carries a reason. A missing report is not counted as a successful apply.
Merge with per-device domain blocks
Section titled “Merge with per-device domain blocks”Global Block Domain and Active Response domain blocks are separate ownership sets on the host:
| Active Response | Global Blocklist | |
|---|---|---|
| Scope | One device / explicit selection | Whole tenant |
| Source | Manual dialog or alert rule | Catalogue policy |
| Lifetime | Ephemeral with undo/expiry | Durable until superseded/disabled |
| Host tag | uec-ar:<actionId> |
uec-gbd:<version> |
The endpoint enforces the union. Removing a domain from one source must not remove a block owned by the other.
Domain rules
Section titled “Domain rules”- Domain targets are valid FQDNs, at most 253 characters.
- Scheme, path and wildcard forms are rejected in v1.
- Loopback, RFC 1918 reverse zones and the agent’s configured server hostname are rejected.
- Host changes are atomic and idempotent.
- A catalogue included in an active blocklist cannot be deleted; remove it by publishing a new version.
Operating safely
Section titled “Operating safely”- Preview before publish.
- Publish during a change window if DNS-blocking mistakes would disrupt business.
- Monitor rollout status, not just “published”.
- Keep an intentional rollback version.
- Disable only when you intend every agent to clear GBD-owned state.
- Audit every catalogue edit, publish, disable and rollback.