---
title: Create an allowlist or blocklist · Cloudflare Learning Paths
description: In the context of DNS filtering, a blocklist is a list of known harmful domains or IP addresses. An allowlist is a list of allowed domains or IP addresses, such as the domains of essential corporate applications.
lastUpdated: 2025-02-26T19:37:05.000Z
source_url:
  html: https://zt-dark-mode-changelog.preview.developers.cloudflare.com/learning-paths/secure-internet-traffic/build-dns-policies/create-list/index.md
  md: https://zt-dark-mode-changelog.preview.developers.cloudflare.com/learning-paths/secure-internet-traffic/build-dns-policies/create-list/
---

In the context of DNS filtering, a blocklist is a list of known harmful domains or IP addresses. An allowlist is a list of allowed domains or IP addresses, such as the domains of essential corporate applications.

Gateway supports creating [lists](https://developers.cloudflare.com/cloudflare-one/policies/gateway/lists/) of URLs, hostnames, or other entries to use in your policies.

## Example list policy

* Dashboard

  The following DNS policy will allow access to all approved corporate domains included in a list called **Corporate Domains**.

  | Selector | Operator | Value | Action |
  | - | - | - | - |
  | Domain | in list | *Corporate Domains* | Allow |

* API

  ```sh
  curl  https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
    --header 'Content-Type: application/json' \
    --header "Authorization: Bearer <API_TOKEN>" \
    --data '{
    "name": "All-DNS-CorporateDomain-AllowList",
    "description": "Allow access to the corporate domains defined under the Corporate Domains list",
    "precedence": 1,
    "enabled": true,
    "action": "allow",
    "filters": [
      "dns"
    ],
    "traffic": "any(dns.domains[*] in $<CORPORATE_DOMAINS_LIST_UUID>)"
  }'
  ```

* Terraform

  To create a new DNS policy using **Terraform** to allow access to all approved corporate domains included in a list called **Corporate Domains**.

  ```tf
  resource "cloudflare_zero_trust_gateway_policy" "allow_corporate_domain_access" {
    account_id  = var.cloudflare_account_id
    name        = "All-DNS-CorporateDomain-AllowList"
    description = "Allow access to the corporate domains defined under the Corporate Domains list"
    precedence  = 1
    enabled     = false
    action      = "allow"
    filters     = ["dns"]
    traffic     = "any(dns.domains[*] in $<Corporate Domains List UUID>)"
  }
  ```
