Pi-hole
A DNS sinkhole that blocks ads, trackers and known-malicious domains for every device on your network, including the ones you can't install anything on.
#What it is
Every time a device wants to reach ads.example.com, it first asks a DNS server for the address. Pi-hole is that DNS server. It checks the name against its blocklists (collectively called gravity) and, if the name is on one, answers 0.0.0.0, an address that goes nowhere. The ad or tracker never loads. Everything else is passed on to a real resolver, in my case Unbound.
Pi-hole v6 is a single engine, pihole-FTL, with the web interface built in. Settings live in /etc/pihole/pihole.toml and can be changed from the command line with pihole-FTL --config.
#Why I use it
It's network-wide. Set the router to hand out the Pi as the DNS server, and every phone, TV, games console and IoT gadget in the house is covered, with no app on any of them. It's also the best free visibility tool on a home network: the query log shows you what every device is actually talking to. Your smart TV will surprise you.
#Benefits
- Fewer ads and trackers everywhere, including inside apps.
- Blocks known-malicious domains before a connection is even attempted.
- A query log that doubles as security telemetry. I ship it into Loki for searching and alerting.
- Light. It barely registers on a Pi.
#Limits and trade-offs
- It can't block what shares a domain with real content. YouTube ads come from the same places as YouTube videos.
- Devices can bypass it by using hard-coded DNS servers or DNS-over-HTTPS. Most don't, but some apps and browsers do.
- It's a single point of failure. If the Pi dies, name resolution stops for the whole house. The rollback is setting the router's DNS back to default.
- Occasional false positives. A site or app breaks, you check the query log, and you allowlist the domain.
- Alternatives: AdGuard Home (similar, with built-in encrypted DNS), or a hosted service like NextDNS (nothing to run, but a third party sees your queries).
#Gotchas I hit
- Always run
pihole-FTL --configwithsudo. Without it the command can't readpihole.tomland may show you a stale value. - Never add a public DNS server as the "secondary". Devices will use it and quietly skip Pi-hole.
- Watch for IPv6 DNS leaks. If the router advertises its own IPv6 DNS server, many devices prefer it. See DHCP.
- Device names instead of IPs: turn on conditional forwarding so Pi-hole asks the router who
192.168.1.66is.