diff --git a/backend/server/api/url-filter/blocklist.txt.get.ts b/backend/server/api/url-filter/blocklist.txt.get.ts
new file mode 100644
index 0000000..f7702cc
--- /dev/null
+++ b/backend/server/api/url-filter/blocklist.txt.get.ts
@@ -0,0 +1,19 @@
+import { getActiveBlocklistDomains } from "../../db/domains";
+
+/**
+ * GET /api/url-filter/blocklist.txt
+ *
+ * Plain-text Blocklist für externe DNS-Filter (AdGuard Home, Pi-hole, etc.).
+ * Eine Domain pro Zeile. Wird vom rebreak-mdm DoH-Server alle 1h gepullt.
+ *
+ * Public — Casino-Domains sind keine PII. Andere Filter-Listen (HaGeZi, OISD)
+ * sind genauso public. Single source of truth mit dem URL-Filter im NEFilter.
+ */
+export default defineEventHandler(async (event) => {
+  const domains = await getActiveBlocklistDomains();
+  const body = domains.map((d) => d.domain).join("\n") + "\n";
+
+  setHeader(event, "Content-Type", "text/plain; charset=utf-8");
+  setHeader(event, "Cache-Control", "public, max-age=300");
+  return body;
+});