Tor: --enable-dns-blocklist leaks DNS queries over clearnet

[libre-7]

Description

When Tor is enabled (--proxy=127.0.0.1:9050), the --enable-dns-blocklist flag causes DNS leaks because monerod's libunbound resolver bypasses the SOCKS proxy and queries blocklist.moneropulse.* domains directly over clearnet.

Impact

Despite all P2P traffic being routed through Tor, an observer (ISP, DNS provider) can see DNS TXT queries to blocklist.moneropulse.se/org/net/no/fr/de/ch, revealing that the user is running a Monero node.

Fix

Provide a static ban list (block.txt) in the Docker image that users can mount or that gets auto-configured when TOR_ENABLED=true. Replace --enable-dns-blocklist with --ban-list=/home/miner/block.txt in the Tor auto-generated arguments.

The static list should mirror the DNS blocklist contents (available from dig blocklist.moneropulse.se TXT).

References

• --enable-dns-blocklist PR: Optional DNS based blocklist monero-project/monero#7138
• DNS blocklist update proposal: DNS block/ban list contents monero-project/meta#1242
• Monero anonymity networks doc: https://github.com/monero-project/monero/blob/master/docs/ANONYMITY_NETWORKS.md