# DoH/DoT bypass Pi-hole

**URL:** <https://discourse.pi-hole.net/t/doh-dot-bypass-pi-hole/80956>\
**Category:** General\
**Created:** [July 2, 2025, 4:37pm UTC](https://discourse.pi-hole.net/t/doh-dot-bypass-pi-hole/80956 "2025-07-02T16:37:10Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![anon82753067](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/a587f6/32.png) [@anon82753067](https://discourse.pi-hole.net/u/anon82753067)\
**Post date:** [July 2, 2025, 4:37pm UTC](https://discourse.pi-hole.net/t/doh-dot-bypass-pi-hole/80956/1 "2025-07-02T16:37:11Z")

</div>

Hello everyone!

I am planning to use Pi Hole, but I have a doubt if it is possible that some devices can bypass pi hole by DNS over HTTPS/TLS. And what are the solutions that can solve this issue?

---

<div class="post-metadata">

**Author:** ![Ladrien](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/ladrien/32/39018_2.png) [@Ladrien](https://discourse.pi-hole.net/u/Ladrien)\
**Post date:** [July 2, 2025, 7:57pm UTC](https://discourse.pi-hole.net/t/doh-dot-bypass-pi-hole/80956/2 "2025-07-02T19:57:36Z")

</div>

There are a few ways to bypass pi-hole. Refer to this post to block the majority of them: [Do individual devices require configuration with Pihole+Unbound?](https://discourse.pi-hole.net/t/do-individual-devices-require-configuration-with-pihole-unbound/77092)

There has also been a new pi-hole setting: `dns.specialDomains.designatedResolver` to prevent clients from upgrading to DoH via the upstream provider. Make sure this is set to true.

Edit: I just want to make clear that these bypasses are not a fault of pi-hole

---

<div class="post-metadata">

**Author:** ![robgill](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/robgill/32/3696_2.png) [@robgill](https://discourse.pi-hole.net/u/robgill)\
**Post date:** [July 2, 2025, 10:24pm UTC](https://discourse.pi-hole.net/t/doh-dot-bypass-pi-hole/80956/3 "2025-07-02T22:24:35Z")

</div>

> [@anon82753067](#):
>
> And what are the solutions that can solve this issue?

On your pihole:

Blocking list to prevent domains of known DoH/DoT providers (eg [GitHub - hagezi/dns-blocklists: DNS-Blocklists: For a better internet - keep the internet clean! · GitHub](https://github.com/hagezi/dns-blocklists#bypass)). But this won't stop everything. Anything using hardcoded IPs will go straight past this step.

Blocking rules on your firewall / modem /router / gateway / whatever to:

Prevent access to ports 53 and 853 except from your Pi-hole.  
Block DoH/DoT hosts by ip address (blocklist such as [GitHub - dibdot/DoH-IP-blocklists: This repo contains the domain names and the resolved IPv4/IPv6 addresses of public DoH server · GitHub](https://github.com/dibdot/DoH-IP-blocklists))

For that you'd need to consult the directions for your device.

---

<div class="post-metadata">

**Author:** ![anon82753067](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/a587f6/32.png) [@anon82753067](https://discourse.pi-hole.net/u/anon82753067)\
**Post date:** [July 3, 2025, 5:08pm UTC](https://discourse.pi-hole.net/t/doh-dot-bypass-pi-hole/80956/4 "2025-07-03T17:08:02Z")

</div>

Thanks for the reply!

In case some users want to use DoH, are there solutions / software that can be combined with Pi-hole to achieve this? While maintaining its functionality.

---

<div class="post-metadata">

**Author:** ![anon82753067](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/a587f6/32.png) [@anon82753067](https://discourse.pi-hole.net/u/anon82753067)\
**Post date:** [July 3, 2025, 6:48pm UTC](https://discourse.pi-hole.net/t/doh-dot-bypass-pi-hole/80956/5 "2025-07-03T18:48:08Z")

</div>

Thanks for the reply!

Just want to make sure if there are Hardcoded IP Addresses, I have to block them using firewall?

---

<div class="post-metadata">

**Author:** ![robgill](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/robgill/32/3696_2.png) [@robgill](https://discourse.pi-hole.net/u/robgill)\
**Post date:** [July 3, 2025, 7:20pm UTC](https://discourse.pi-hole.net/t/doh-dot-bypass-pi-hole/80956/6 "2025-07-03T19:20:26Z")

</div>

> [@anon82753067](#):
>
> In case some users want to use DoH, are there solutions / software that can be combined with Pi-hole to achieve this? While maintaining its functionality.

You could set up a DoH proxy pointing to your Pi-hole, such as [https://github.com/DNSCrypt/doh-server](https://github.com/DNSCrypt/doh-server).

There is no particular benefit to operating a DoH server on your own network. Also, most devices won't accept self-signed certificates for their DoH, so you'll also need certificates for it (eg from letsencrypt). You then need to announce it to network clients, and there are varying ways to do this which many devices don't respect and will still be looking for the server that they want anyway.

It's a fair bit of effort for no real benefit.

> [@anon82753067](#):
>
> Just want to make sure if there are Hardcoded IP Addresses, I have to block them using firewall?

Unfortunately so.

---

<div class="post-metadata">

**Author:** ![anon82753067](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/a587f6/32.png) [@anon82753067](https://discourse.pi-hole.net/u/anon82753067)\
**Post date:** [July 9, 2025, 1:02pm UTC](https://discourse.pi-hole.net/t/doh-dot-bypass-pi-hole/80956/7 "2025-07-09T13:02:59Z")

</div>

Which firewall is recommended to block the hardcoded IPs?  
And where should I implement it? With the device that includes the Pi-hole? Or at the router level?

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [July 9, 2025, 1:51pm UTC](https://discourse.pi-hole.net/t/doh-dot-bypass-pi-hole/80956/8 "2025-07-09T13:51:40Z")

</div>

> [@anon82753067](#):
>
> Which firewall is recommended to block the hardcoded IPs?

The one that you already have, most likely the firewall on your router.

Note that when **robgill** suggested "_blocking rules on your firewall / modem /router / gateway / whatever_", he was referring to devices. 'Firewall' in that context would mean a dedicated firewall device that acts as a gateway for all your network's traffic.

> [@anon82753067](#):
>
> And where should I implement it? With the device that includes the Pi-hole?

No, as your Pi-hole device's firewall software would only affect traffic originating from or destined to that very device.

You need to block IPs at the router / gateway level.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [July 16, 2025, 1:52pm UTC](https://discourse.pi-hole.net/t/doh-dot-bypass-pi-hole/80956/9 "2025-07-16T13:52:37Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.