What you see doesn't seem unusual.
Most networking utilities and applications will try to resolve a given hostname by appending the local search domain suffix (that's the point of having that, after all), e.g. nslookup
does so while dig
doesn't by default (you can enforce it using dig +search
).
The situation is less consistent with regards to expanding fully qualified domain names (like www.wikipedia.org
) by a search suffix, e.g. Windows nslookup
will do so by default, while Linux versions may or may not (as controlled by the ndots
option, e.g. see man resolv.conf
).
So if you e.g. run nslookup
from a Windows command prompt, you'll see two sets of DNS queries arriving in Pi-hole's Query Log, one with the suffix appended and one without.
So nothing to worry about, really.