Lots of queries but very little adblocking

[chrislph]

Thanks for running those commands. They reveal that something is intercepting your DNS queries and sending them to its own server instead.

The first one tells Windows to ask its DNS server to resolve flurry.com (a domain that is usually blocked by Pi-hole). Your debug log shows that Windows should be using Pi-hole. And you can see Windows thinks it is asking Pi-hole. But the answer that comes back is the IP of flurry.com.

The second one is the same test but this time forcing Windows to ask Pi-hole. Same result as the first test.

The last one tells Windows to ask for some specific details from a particular DNS server on the Internet. The result that should come back is the text "ATLAS". And Windows does indeed think it's talking to that server, but the text that comes back is "unbound 1.13.2" which is a different DNS server responding.

So where is this happening? There are a few possibilities.

We've seen this before, with that same text version too, when someone had AVG installed on their computer. Does that apply to you?

An AVG feature called "Fake Website Shield" was hijacking all their DNS commands and sending them to AVG's server instead, so Windows thought it was talking to Pi-hole and these other servers, but in fact it was talking with AVG's DNS server.

PiHole working, but not blocking anything on client devices

Thankyou for running those tests, that is much appreciated. The answers show that indeed your computer is hijacking your DNS queries and sending them to different DNS servers instead of Pi-hole and all the test servers. Each command is asking a different DNS server to display a text string showing its version. The answers should be different for each one. But instead, they are all the same because it's the same hijacking DNS server responding each time. Since you are running AVG then this is v…

Another option might be a VPN on the computer which is messing with DNS queries.

One other possibility is your ISP itself is intercepting DNS queries, including those which technically shouldn't even leave your network, and handling them instead of Pi-hole. Or something in your router which is doing the same. These seem less likely than the first two but I mention it for completeness. For example if the ISP or router has some sort of "supporting software" that has been installed on Windows.

Do you have any other Windows or Apple computers you can try those commands on?

It would be interesting to see the following commands run from your Pi-hole terminal, to see what that gives.

nslookup flurry.com 127.0.0.1

nslookup -class=chaos -type=txt version.bind 198.41.0.4