Pi-hole blocks the website even while it's not (and never was) on any blacklist. In the query log I see that sometimes the website is appended by our DNS name. This is very strange, it happens only on this website. So in the query log there are entries like this: https://www.hollandmarineparts.nl.ad.contoso.com
I've noticed that this mostly happens when the website is loaded over http instead of https. We cannot enforce https because it causes redirect loops. The website will be rebuild later this year. Until then I hope we can freely browse the website on our network.
Note that whitelisting the site doesn't help in this case.
These tools can help determine why desired content will not load.
I applied the tools and opened the website using Pi-Hole with the stock blocklists and some additional regex. The website opened normally AdamOne Assistant shows the following domains requested.
Seems like you either run an Active Directory controller in your network or your router is assigning ad.contoso.com as a search domain for your network.
As such,.it would seem normal that Windows clients would append that domain to DNS searches on occasions.
It would also seem normal that Pi.hole wouldn't be able to resolve the resulting name and forward it to its upsteam DNS server, and that would very likely fail with no such domain (which is does for me).
So if you are seeing those requests failing, do they really get blocked by Pi-hole, or do they simply get forwarded to answer NXDOMAIN?
If the former, you should follow mmottis advice and check your regex.
EDIT: Does not seem to be the case, as of your debug log qouted above by @jfb.
In the latter case, you could either search if you can
a) ignore it, as most apps should do a DNS lookup without the local domain search suffix after that one fails
b) try to configure your clients to foregoe appending the search domain if not needed (no idea how you'd do that, though)
c) try to extend Pi-hole by a host record for www.hollandmarineparts.nl.ad.contoso.com. Note that this may result in further trouble, as your website (or whatever is residing at that domain) might not at all handle that unusual name well in places.
In any case, your problem seems to apply to your specific network configuration, as I wasn't able to reproduce it with a stock configuration.
Even when artificially introduding a blocking regex, the result would be the same as receiving an NXDOMAIN for the user.
There are some strange things going on. ALL company traffic goes trough DNS servers 192.168.1.1 and 192.168.1.2, but this request comes from localhost..? Also the request is allowed but it's clearly blocked in the browser. The reply type is NOTIMP. Not implemented?? Why would that be?
Hmm. @ Bucking_Horn our router is indeed assigning ad.contoso.com as search domain from the network, but it has been doing that for ages. I would not know why it will be a problem for only this website. We have 30 users browsing the web every day and only this one has an issue with it.
I have checked DNS records now for the domain hollandmarineparts.nl. I see we are missing an A record for the www subdomain without a wildcard record. I have added the www record now.
Doing nslookup test.hollandmarineparts.nl. returned the ip address of the pi-hole. Doing this in the browser would generate the same 404 error.
It could be that this explains the issue, although www.hollandmarineparts.nl has been functioning correctly all over the world for everyone else. I almost can't believe this was really the issue.
