I add some key words of blocked domain in the regex list. If I add these key words more than two, pihole will also block domains with "download" keywords. And I tried to empty the regex list and do a repeat way. This issue will show l, too.
For an example
I add one regex keywords of the domain name I want to block. After this action, if I add a keyword again, I use nslookup or dig command, it will return like it below
How do you know this to be the case? The domain could be in your gravity list.
In this case, which key word did you add as a regex (and how does it appear in /etc/pihole/regex.list ), and what does the query log show for this lookup?
The query log will tell you if the query was blocked by gravity or by regex.
Example - I made a wildcard blacklist entry for "ru.com". Then I ran dig dog.ru.com and the reply is 0.0.0.0 from Pi-Hole (it was blocked). The query log shows the following:
With regex debugging mode on, this query shows in /var/log/pihole-FTL.log as follows, showing me again that the blocking was done by this regex filter.
[2019-02-11 12:03:21.846] DEBUG: Regex in line 3 "(^|\.)ru\.com$" matches "dog.ru.com"
The tail logs shows me it has been blocked by regex list, but my regex and gravity list dosen't has that keywords. That's to say, when I lookup a domain contains "download" at will, it'll must be blocked, if there are over than two keywords.