DNS Settings
Upstream DNS Servers
| IPv4 | IPv6 | Name | ||
|---|---|---|---|---|
ECS (Extended Client Subnet) defines a mechanism for recursive resolvers to send partial client IP address information to authoritative DNS name servers. Content Delivery Networks (CDNs) and latency-sensitive services use this to give geo-located responses when responding to name lookups coming through public DNS resolvers. Note that ECS may result in reduced privacy.
Custom DNS servers
DNS domain settings
The DNS domains for your Pi-hole. This DNS domain is purely local. FTL may answer queries from its local cache and configuration but *never* forwards any requests upstream *unless* you have configured a dns.revServer exactly for this domain. If no domain is specified and you are using Pi-hole's DHCP server, then any hostnames with a domain part (i.e., with a period) will be disallowed. If a domain is specified, then hostnames with a domain parts matching the domain here are allowed. In addition, when a suffix is set then hostnames without a domain part have the suffix added as an optional domain part.
If set, the domain is added to simple names (without a period) in /etc/hosts in the same way as for DHCP-derived names.
Rate-limiting
Block clients making more than queries within seconds.
When a client makes too many queries in too short time, it
gets rate-limited. Rate-limited queries are answered with a
REFUSED reply and not further processed by FTL
and prevent Pi-holes getting overwhelmed by rogue clients.
It is important to note that rate-limiting is happening on a
per-client basis. Other clients can continue to use FTL while
rate-limited clients are short-circuited at the same time.
Rate-limiting may be disabled altogether by setting both values to zero. See our documentation for further details.
Interface settings
Recommended setting
Potentially dangerous options
Make sure your Pi-hole is properly firewalled!These options are dangerous on devices directly connected to the Internet such as cloud instances and are only safe if your Pi-hole is properly firewalled. In a typical at-home setup where your Pi-hole is located within your local network (and you have not forwarded port 53 in your router!) they are safe to use.
See our documentation for further technical details.
Advanced DNS settings
Tells Pi-hole to never forward A or AAAA queries for plain
names, without dots or domain parts, to upstream nameservers. If
the name is not known from /etc/hosts or DHCP then a "not found"
answer is returned.
If Conditional Forwarding is enabled, unticking this box may cause a partial
DNS loop under certain circumstances (e.g. if a client would send TLD DNSSEC queries).
All reverse lookups for private IP ranges (i.e., 192.168.0.x/24, etc.)
which are not found in /etc/hosts or the DHCP leases are answered
with "no such domain" rather than being forwarded upstream. The set
of prefixes affected is the list given in RFC6303.
Important:
Enabling these two options may increase your privacy,
but may also prevent you from being able to access local hostnames if the Pi-hole is not used as DHCP server.
Make sure you have set up conditional forwarding in this case.
Validate DNS replies and cache DNSSEC data. When forwarding DNS queries, Pi-hole requests the DNSSEC records needed to validate the replies. If a domain fails validation or the upstream does not support DNSSEC, this setting can cause issues resolving domains. Use an upstream DNS server which supports DNSSEC when activating DNSSEC. Note that the size of your log might increase significantly when enabling DNSSEC. A DNSSEC resolver test can be found here.
Conditional forwarding
If not configured as your DHCP server, Pi-hole typically won't be able to determine the names of devices on your local network. As a result, tables such as Top Clients will only show IP addresses.
One solution for this is to configure Pi-hole to forward these requests to your DHCP server (most likely your router), but only for devices on your home network. To configure this we will need to know the IP address of your DHCP server and which addresses belong to your local network. Exemplary input is given below as placeholder in the text boxes (if empty).
If your local network spans 192.168.0.1 - 192.168.0.255, then you will have to input
192.168.0.0/24. If your local network is 192.168.47.1 - 192.168.47.255, it will
be 192.168.47.0/24 and similar. If your network is larger, the CIDR has to be
different, for instance a range of 10.8.0.1 - 10.8.255.255 results in 10.8.0.0/16,
whereas an even wider network of 10.0.0.1 - 10.255.255.255 results in 10.0.0.0/8.
Setting up IPv6 ranges is exactly similar to setting up IPv4 here and fully supported.
Feel free to reach out to us on our
Discourse forum
in case you need any assistance setting up local host name resolution for your particular system.
You can also specify a local domain name (like fritz.box) to ensure queries to
devices ending in your local domain name will not leave your network, however, this is optional.
The local domain name must match the domain name specified
in your DHCP server for this to work. You can likely find it within the DHCP settings.
Enabling Conditional Forwarding will also forward all hostnames (i.e., non-FQDNs) to the router when "Never forward non-FQDNs" is not enabled.
The following list contains all reverse servers you want to add. The expected format is one server per line in form of <enabled>,<ip-address>[/<prefix-len>],<server>[#<port>][,<domain>]. A valid config line could look like true,192.168.0.0/24,192.168.0.1,fritz.box