# Pi hole not blocking TXT records with regex filters

**URL:** <https://discourse.pi-hole.net/t/pi-hole-not-blocking-txt-records-with-regex-filters/27575>\
**Category:** Help\
**Created:** [January 28, 2020, 2:28pm UTC](https://discourse.pi-hole.net/t/pi-hole-not-blocking-txt-records-with-regex-filters/27575 "2020-01-28T14:28:53Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gordonsyme](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/g/e47774/32.png) [@gordonsyme](https://discourse.pi-hole.net/u/gordonsyme)\
**Post date:** [January 28, 2020, 2:28pm UTC](https://discourse.pi-hole.net/t/pi-hole-not-blocking-txt-records-with-regex-filters/27575/1 "2020-01-28T14:28:54Z")

</div>

## Expected Behaviour:

Record types other than A/AAAA are also blocked when they match a regex filter

## Actual Behaviour:

TXT records are being forwarded to the upstream DNS provider

Excerpt from /var/log/pihole-FTL.log

```auto
[2020-01-28 14:05:02.596 17213] Regex in line 2 "sophosxl\.net$" matches "qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net"
[2020-01-28 14:05:02.600 17213] Added qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net to cache
[2020-01-28 14:05:02.600 17213] **** forwarded qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net to 1.0.0.1 (ID 61, dnsmasq/forward.c:558)
[2020-01-28 14:05:02.601 17213] **** forwarded qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net to 1.1.1.1 (ID 61, dnsmasq/forward.c:558)

```

And the corresponding row in the UI is:

```auto
2020-01-28 14:05:02 TXT	qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net	192.168.42.103	OK (forwarded)	N/A

```

Upstream doesn't reply with response, not sure if that should make any difference. These queries are actually used to send data to a service rather than to look up a name.

```auto
$ dig TXT @1.1.1.1 qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net

; <<>> DiG 9.10.6 <<>> TXT @1.1.1.1 qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 54763
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
;; QUESTION SECTION:
;qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net. IN TXT

;; Query time: 37 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Tue Jan 28 14:17:41 GMT 2020
;; MSG SIZE rcvd: 70

```

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [January 28, 2020, 3:54pm UTC](https://discourse.pi-hole.net/t/pi-hole-not-blocking-txt-records-with-regex-filters/27575/2 "2020-01-28T15:54:30Z")

</div>

see [here](https://discourse.pi-hole.net/t/problem-with-regex/26747/4), no longer a problem in [beta5](https://discourse.pi-hole.net/t/announcing-a-beta-test-of-pi-hole-5-0/27059), apparently (not yet tested).

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [January 28, 2020, 4:41pm UTC](https://discourse.pi-hole.net/t/pi-hole-not-blocking-txt-records-with-regex-filters/27575/3 "2020-01-28T16:41:14Z")

</div>

> [@gordonsyme](#):
>
> Expected Behaviour:
> 
> Record types other than A/AAAA are also blocked when they match a regex filter

As noted above, this is not the expected behavior in V4.x.

---

<div class="post-metadata">

**Author:** ![gordonsyme](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/g/e47774/32.png) [@gordonsyme](https://discourse.pi-hole.net/u/gordonsyme)\
**Post date:** [January 28, 2020, 4:42pm UTC](https://discourse.pi-hole.net/t/pi-hole-not-blocking-txt-records-with-regex-filters/27575/4 "2020-01-28T16:42:14Z")

</div>

Ah, thank you all for the info

-Gordon

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [February 4, 2020, 4:18pm UTC](https://discourse.pi-hole.net/t/pi-hole-not-blocking-txt-records-with-regex-filters/27575/5 "2020-02-04T16:18:10Z")

</div>

also mentioned [here](https://discourse.pi-hole.net/t/problem-with-regex/26747/3) (topic already closed, so no update)

```auto
The current `development` version already blocks all types of requests so you won’t need to do anything in addition.
FTL v4.x blocks only `A` and `AAAA`

```

I've been running Beta5 for a couple of days now, and can confirm pihole-FTL now blocks all types of requests (no SURICATA alerts anymore).

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [February 25, 2020, 4:18pm UTC](https://discourse.pi-hole.net/t/pi-hole-not-blocking-txt-records-with-regex-filters/27575/6 "2020-02-25T16:18:16Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.