I really want to find out.

I already had two pi-hole instances running (one in LXD on x86, another in Docker on arm64), using keepalived to float a VIP from Primary to Secondary and back when the primary goes down, kept in sync with NebulaSync.

It wasn't perfect, and all queries would go to the primary until it went down, then would go to the secondary. I wanted more, so I added dnsdist, which now properly spreads the DNS queries across the two instances.

It looks like this now.

This allows my config to survive even more failure modes than the previous:

• If either Pi-hole fails, dnsdist removes it and sends all queries to the surviving Pi-hole.
• If either local Unbound fails, your end-to-end health check should cause that Pi-hole backend to be removed.
• If the active dnsdist process fails, Keepalived’s functional check lowers that host’s priority and moves the VIP.
• If the primary physical host fails, the secondary takes 192.168.4.5.
• Maintenance can be performed on one Pi-hole/Unbound stack without interrupting DNS.

It uses dnsdist to receive the request → Pi-hole → unbound → NextDNS when on the LAN or VPN. When I'm off-premises, I use NextDNS exclusively, which offers less protection, but plenty for my needs.

I'm already blocking thousands of queries per-day. Every little bit helps.

With the Homepage widgets and Pi-Bar on my macOS desktop,. I can see everything at a glance.

I'll write this all up on a Github gist soon, if anyone is interested. It was trivially simple to drop in.

As of today, Air Play is not working on my LG TV anymore. I have a smart TV blocklist and for sure the LG TV is one of the most blocked clients on my network.

Is anyone aware of requests I should allow to be able to connect?

Ran into this the hard way and I keep seeing others make the same assumption, so I want to both flag it and hear how people handle it.

The assumption: routing your resolver through your VPN tunnel is "more private." The reality with Mullvad and most WireGuard VPNs is that port 53 gets hijacked in-tunnel. So if your Unbound is doing recursion inside the tunnel, it silently breaks and resolution quietly falls back to the VPN provider's own resolver. Pi-hole still shows queries, everything looks fine, but your carefully built chain is bypassed and you're using their DNS.

What actually worked for me: Pi-hole -> self-hosted Unbound -> DoT to an encrypted upstream, with direct egress, never through the tunnel. Still encrypted end to end, but the resolver path stays under my control and my Pi-hole filtering actually applies. The VPN only carries the traffic that's supposed to be in it.

That leaves me with a design question I keep going back and forth on, and I'd like other people's take:

Unbound as a recursive resolver vs Unbound forwarding over DoT to an upstream. Full recursion is the "purest" answer and talks to root servers directly, but it can't live inside the tunnel for the reason above, and it leaks a different metadata pattern to authoritatives. DoT-forwarding hands trust to one upstream but is clean, fast, and encrypted. I went DoT-forward. Where did you land, and why? And has anyone found a clean way to keep true recursion while still getting VPN egress for the rest of the network?

I am trying to set up pi hole on my pi zero w and after flashing it first it says verrification failed contents on the sd card dont match then ive tried to skip verification but it still isnt working when i try to connect to it via command prompt

android has a big gap as it doesn't allow you to set the DNS for ipv6. easy workaround is to just disable ipv6 altogether but i would rather use it.

i also would like to automatically get basic ad protection in the entire phone when i'm outside the home. one way of doing that even without pihole is to use one of those apps that create a vpn tunnel to get around android's restriction (or use something like tailscale or wireguard with the same practical effect)

android has a private dns feature which I believe would work without the vpn requirement, however the downside is that it requires a FQDN (to validate a certificate). This would mean I would need to own a public domain name and create a dns record pointing to the pihole private ip address so that at least private dns can work from home, but it also means I need some kind of web server / reverse proxy to be able to install a let's encrypt certificate. this also wouldn't work when outside of home because i would need to also expose the public ip address (or again use a vpn)

based on the above it looks like the most secure option and the easiest one would be to have a permanent vpn on my phone at all times and be subject to the battery drain (i once saw android reporting 40% battery drain from tailscale)

if someone has ran into the above problem, which approach did you use? am i missing any other approach? I'm aware i could use Tasker to detect if i am not connected to my home wifi and thus perhaps configure private dns with a public basic ad blocking dns server (adguard?)

I currently have pi-hole running on my old synology 1512+ through docker and it's really bogging down my system. Since I have only 1GB of RAM on it and on top of that I have other services like my plex media server running on it too. At first it was running okay, but as time went by, it's gotten extremely slow when pulling up anything on the internet on my devices.

I am interested in getting a respberry pi for this but not sure exactly which one to get. I'm looking for something that will make the entire installation process quick and easy. I can see they sell the motherboard alone and you would have to supply your own micro SD card, power supply, fan, case, ethernet cable, etc. I would prefer an all in one solution if its available. For those who are running pi-hole/unbound on a raspberry pi, could you please help me out and point me in the right direction? Thanks.

Hi there

How do I block Apple Private Relay? Note: I would like to create a custom rule instead of using the setting.

Do you have a screenshot of what pops up when I apply that rule?

Is PiHole supposed to work with Pop-ups that redirect to other site or is that not considered and ad for these intents and purposes?

Hello im running pi-hole for a while now but theres one thing that bothering me. I saw in dashboard clients that my computer hostname shows on many diffrent adresses in my local network. mac is diffrent on those devices. My pc has static ip and is visible. I have added 2 of my devices to local dns records but my pc is not one of them since somehow pi-hole knows the hostname so i didnt bother adding it. Its also not added as a "static client" in the clients tab. What can be a cause of this problem?

EDIT: Fixed it by following suggestions from this post and also disabling ipv6 nameresolver

Spotted more ads creeping through while browsing recently after installing the public beta of iOS27. Checked for DNS leaks and found my mobile network’s DNS servers being used even though I was connected via WiFi and using Pi-Hole as DNS.

Turns out that “Connectivity Assist” (which I don’t remember turning on, so assume it’s on by default) was forcing my iPhone to use its cellular connection for at least the DNS look-up!

Turning off Connectivity Assist plugged the leak.

Just an FYI.

Exactly as the title says. I was able to put the top Client total using the following query:

topk(15, sum by(source) (pihole_top_sources))

But I'm not able to get the Top Clients(block only) because I cannot find the right Metric to pull from. The auto complete does not show anything additional. Does anyone have experience in getting data from pihole like this? Or, has anyone done this exact thing before.

[EDIT]

Since posting this I realized that the Pihole top sources is just the top clients total and blocked only combined. So im wondering how they are filtering this data into these two buckets.

I’m running the Pi Hole on a Raspberry Pi Zero 2W

I followed the instructions from the sidebar for Linux devices as closely as I could https://discourse.pi-hole.net/t/how-do-i-configure-my-devices-to-use-pi-hole-as-their-dns-server/245

However I only intermittently see blocked traffic in the logs from my mint pc.

The network connections details page shows the correct DNS. It lists my router as the default route.

Current Settings
In ip4 I have auto dhcp, manual DNs, auto routes with blank lines

In ip6 I have
Addresses automatic (though I also tried auto dhcp only)
DNS automatic (tried manual pi ip but it turned red so I cleared it, also tried manual ip with the line blank)
Routes automatic with lines blank ( also tried manual with the lines blank but the browser wouldn’t connect to anything)

anybody seen anything like this before in their logs?

Pi hole was working. 1 client exceeded the default threshold. They got blocked. I changed the rate limit from 1000 to 1000 and that now makes every website unusable for the entire network. Why? How do I fix this? I restarted both pi hole and my server. I’m running pi hole in docker on my Mac. I also stopped pi hole entirely and my websites still won’t load.

I’m trying to find out whether anyone else can reproduce this.

**My setup:**
• Local AdGuard Home on Raspberry Pi
• Home Wi-Fi uses a manually configured local DNS server (192.168.1.x)
• Cellular uses an iOS DNS-over-HTTPS configuration profile
• Private Relay is OFF

After updating to **iOS 27 Developer Beta 3** (now also reproduced on the Public Beta branch), I started seeing a strange issue.

After the phone sits idle for several hours (typically overnight), DNS-based filtering suddenly stops working.

**Symptoms:**
• Ads that were previously blocked (e.g. Google/DoubleClick) start loading.
• Internet connectivity still works normally.
• My AdGuard server itself is healthy.
• The same DNS server works perfectly through Tailscale.

**Initially I suspected:**
• Cloudflare Tunnel
• AdGuard Home
• IPv6
• the DNS profile itself

But none of those fully explained the behavior.

Then I noticed something interesting.

Around the time the issue occurs, iOS sometimes displays:
***“Connectivity Assist - iPhone is using cellular data in addition to Wi-Fi for a more reliable internet connection.”***

After disabling **Connectivity Assist**, I have not been able to reproduce the issue so far, even after leaving the phone idle overnight.

I’m not claiming Connectivity Assist is the root cause, but it currently looks like a strong correlation.

**Questions:**
1) Has anyone else seen DNS settings seemingly being ignored after long idle?
2) Does disabling Connectivity Assist make any difference for you?
3) I initially reproduced this on DB3 and Public Beta. If you’ve already updated to **Developer Beta 4**, could you test if this idle DNS bypass is still present with Connectivity Assist enabled?

I’d appreciate any confirmations or alternative explanations.

**TL;DR:** On iOS 27 Developer Beta, after several hours of idle on home Wi-Fi, DNS filtering (AdGuard Home / Pi-hole) stops working and ads load. Disabling **Connectivity Assist** (*Settings > Wi-Fi*) seems to fix it. Looking for DB4 users to confirm if this DNS bypass/leak is still happening.

Pi‑hole already handles the ad‑blocking — the upstream resolver you forward to only decides the speed, privacy, and security of resolution, which trips a lot of people up. Quick summary of what I settled on: Cloudflare (1.1.1.1) for raw speed, Quad9 for malware blocking that complements Pi‑hole without double‑filtering ads, and dns0.eu / Mullvad if you want EU/no‑log. Encrypt the hop with cloudflared or DoT so queries leaving Pi‑hole aren't in the clear.

Full disclosure: I built a free browser DNS speed test + an "upstream for Pi‑hole" writeup while figuring this out — no account, nothing stored, and it's upfront that a browser can't do a raw UDP benchmark. Links in a comment so this isn't just a promo post. Curious what you all forward to and why.

https://testsdns.com/

Im wondering if a raspberry pi sink hole will allow me to watch streamed tv shows on something like Disney or Tubi without the ad breaks or even listen to music ad free on Spotify.

Some devices hit the 150 too easily and I need to increase to 1000

In another thread there were talk about smart devices finding ways around piholes and that its mostly for blocking ads.

Would it be futile for a total armature setting up a pihole and expecting it to block smart devices from sending back data?

I use lists from blocklistproject and noticed that they changed the default branch name from master to main. This made links to blocklists to return 404. Looks like this happened about 2 weeks ago.

if you use them, and haven't checked your pihole in a while, have look. You should be able to just change /master/ part of the url to /main/ and it should work again.

---

To check, go to Lists from the left menu, and ensure all your lists have a green icon and not red or orange. You can also go to Tools > pi-hole diagnostics and see if there are failures related to Gravity.

If you are affected, you can create a new entry for each list (with the /main/ link), and delete the old one. Then Tools > Update Gravity to fetch them again.