# Pihole seems to be redirecting all local DNS to the internet

**URL:** <https://discourse.pi-hole.net/t/pihole-seems-to-be-redirecting-all-local-dns-to-the-internet/68934>\
**Category:** Help\
**Created:** [March 12, 2024, 9:54pm UTC](https://discourse.pi-hole.net/t/pihole-seems-to-be-redirecting-all-local-dns-to-the-internet/68934 "2024-03-12T21:54:56Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![indigodelta](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/i/d26b3c/32.png) [@indigodelta](https://discourse.pi-hole.net/u/indigodelta)\
**Post date:** [March 12, 2024, 9:54pm UTC](https://discourse.pi-hole.net/t/pihole-seems-to-be-redirecting-all-local-dns-to-the-internet/68934/1 "2024-03-12T21:54:56Z")

</div>

I have a standard Pihole setup that is configured as my only DNS and DHCP server on my network. It all seems to be working with Pihole correctly identifying the IP from the name, except that every request for a resource on my local network seems to be being forwarded to the upstream DNS server (Google). Below is the logfile. Is there something I can do to stop this?

```auto
Mar 12 22:46:11: query[A] nas2.home from 192.168.1.246
Mar 12 22:46:11: Pi-hole hostname nas2.home is 192.168.1.2
Mar 12 22:46:11: query[HTTPS] _7878._https.nas2.home from 192.168.1.246
Mar 12 22:46:11: forwarded _7878._https.nas2.home to 8.8.4.4
Mar 12 22:46:11: reply _7878._https.nas2.home is NXDOMAIN

```

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [March 12, 2024, 10:19pm UTC](https://discourse.pi-hole.net/t/pihole-seems-to-be-redirecting-all-local-dns-to-the-internet/68934/2 "2024-03-12T22:19:50Z")

</div>

Your output shows that the [A] queries (IPv4) are being answered locally.

```auto
Mar 12 22:46:11: query[A] nas2.home from 192.168.1.246
Mar 12 22:46:11: Pi-hole hostname nas2.home is 192.168.1.2

```

The [HTTPS] queries are being forwarded, as expected, because there is no local answer to this query.

> [@What is this “OTHER” category about?](https://discourse.pi-hole.net/t/what-is-this-other-category-about/38490):
>
> Hello guys. First and foremost I haven’t been on the Discourse site for a while so I apologize in advance if this has been touched on already, but a quick search didn’t yield any results. Lately, I’ve noticed a very large amount of queries classified as “OTHER”. Most of these queries were once classified as “A” or “AAAA”. Even “discourse.pi-hole.net” is classified as a “OTHER” query. I’m sure this isn’t affecting blocking in any way, I’m just curious as to what changes took place as I’ve never h…

---

<div class="post-metadata">

**Author:** ![indigodelta](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/i/d26b3c/32.png) [@indigodelta](https://discourse.pi-hole.net/u/indigodelta)\
**Post date:** [March 12, 2024, 10:34pm UTC](https://discourse.pi-hole.net/t/pihole-seems-to-be-redirecting-all-local-dns-to-the-internet/68934/3 "2024-03-12T22:34:24Z")

</div>

Thank you for your reply but I don't understand what you mean by "no local answer to this query". Would you mind please elaborating on this a bit so I can try to find out how to fix this? Thank you.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [March 12, 2024, 10:42pm UTC](https://discourse.pi-hole.net/t/pihole-seems-to-be-redirecting-all-local-dns-to-the-internet/68934/4 "2024-03-12T22:42:12Z")

</div>

An [HTTPS] query is a non-standard query, and isn't yet supported in the RFC's (documents that govern internet protocols). This is discussed in the link I provided. The answer to [HTTPS] queries at this point in time will always be NXDOMAIN (the domain does not exist on the internet)/

Your Pi-hole can answer [A] or [AAAA] queries for local domains, if it knows the names of the domains which match particular IP's.

Here is a brief description of the various sources (and the order in which they are used) for Pi-hole to provide a local domain name:

> [@Custom DNS - Observations](https://discourse.pi-hole.net/t/custom-dns-observations/27533/17):
>
> Love this new feature/functionality adding all my devices under .lan - smooth! As for the name....I figured it out so "Custom" is OK, possibly "User DNS config", "Local DNS config" or "DNS Override" (assuming this functionality takes priority?)

As an example, on my Pi I have all my regular network clients mapped in a hosts file. I can ask Pi-hole for the name or IP of a client, and it will look in the hosts file and provide it.

```auto
nanopi-neo:~:# nslookup printer
Server: 127.0.0.1
Address:	127.0.0.1#53

Name:	printer
Address: 192.168.0.4

nanopi-neo:~:# nslookup 192.168.0.4
4.0.168.192.in-addr.arpa	name = Printer.

```

---

<div class="post-metadata">

**Author:** ![indigodelta](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/i/d26b3c/32.png) [@indigodelta](https://discourse.pi-hole.net/u/indigodelta)\
**Post date:** [March 12, 2024, 11:26pm UTC](https://discourse.pi-hole.net/t/pihole-seems-to-be-redirecting-all-local-dns-to-the-internet/68934/6 "2024-03-12T23:26:20Z")

</div>

Thanks. This makes more sense now. I have my name defined in the Local DNS Records section of the web UI and it seems like pihole is recognising this and resolving it correctly, but that doesn't answer the original question about the [HTTPS] queries being sent to the internet. Since Pihole doesn't understand [HTTPS] queries, does this mean that all DNS requests for my local resources from a web browser that uses DNS over HTTPS is sent to the internet and there's no way to stop it?

 ![Screenshot 2024-03-13 002845](https://discourse.pi-hole.net/uploads/default/original/3X/8/a/8a86fa4a7a7405f63d9f3a3b538902f8ca04eb07.png)

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [March 13, 2024, 9:11pm UTC](https://discourse.pi-hole.net/t/pihole-seems-to-be-redirecting-all-local-dns-to-the-internet/68934/7 "2024-03-13T21:11:06Z")

</div>

Please upload a debug log and post **just the token URL** that is generated after the log is uploaded by running the following command from the Pi-hole host terminal:

```auto
pihole -d

```

or do it through the Web interface:

_ **Tools \> Generate Debug Log** _

---

<div class="post-metadata">

**Author:** ![rdwebdesign](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rdwebdesign/32/51363_2.png) [@rdwebdesign](https://discourse.pi-hole.net/u/rdwebdesign)\
**Post date:** [March 13, 2024, 10:14pm UTC](https://discourse.pi-hole.net/t/pihole-seems-to-be-redirecting-all-local-dns-to-the-internet/68934/8 "2024-03-13T22:14:42Z")

</div>

> [@indigodelta](#):
>
> but that doesn't answer the original question about the [HTTPS] queries being sent to the internet. Since Pihole doesn't understand [HTTPS] queries

I think I understand your confusion.

The [**HTTPS**](https://datatracker.ietf.org/doc/html/draft-ietf-dnsop-svcb-https-00) query type and the [**https://**](https://en.wikipedia.org/wiki/HTTPS) protocol are different things, but they use the same name (causing this confusion).

**HTTPS** is a type of DNS resource record, like: A, AAAA, DNSKEY, SOA, SRV, TXT, etc. ([more record types](https://en.wikipedia.org/wiki/List_of_DNS_record_types)).

In this context, **HTTPS** queries are not directly related to the use of **https://** protocol on on your browser.

* * *

Note:

The debug log _(asked by **Bucking\_Horn** )_ would help us understand why this queries are being sent to upstream servers

---

<div class="post-metadata">

**Author:** ![indigodelta](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/i/d26b3c/32.png) [@indigodelta](https://discourse.pi-hole.net/u/indigodelta)\
**Post date:** [March 14, 2024, 7:41pm UTC](https://discourse.pi-hole.net/t/pihole-seems-to-be-redirecting-all-local-dns-to-the-internet/68934/15 "2024-03-14T19:41:47Z")

</div>

Thank you. Here's the token.

[https://tricorder.pi-hole.net/NSsHFS1E/](https://tricorder.pi-hole.net/NSsHFS1E/)

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [March 15, 2024, 7:36am UTC](https://discourse.pi-hole.net/t/pihole-seems-to-be-redirecting-all-local-dns-to-the-internet/68934/17 "2024-03-15T07:36:42Z")

</div>

> [@indigodelta](#):
>
> does this mean that all DNS requests for my local resources from a web browser that uses DNS over HTTPS is sent to the internet and there's no way to stop it?

You can add the following line to your custom configuration `/etc/dnsmasq.d/03-dhcp-options.conf`:

```auto
local=/home/

```

then run a _`dnsmasq`_ syntax check:

```auto
docker exec <container-name-or-id-here> pihole-FTL dnsmasq-test

```

If ok, restart your Pi-hole, e.g. via Settings | Restart DNS resolver.

This would configure Pi-hole to answer queries locally from DHCP, `/etc/hosts`, or its _Local DNS_ record definitions, but to _not_ forward `*.home` queries upstream.

Pi-hole v6 will include the respective configuration by default.

* * *

Unrelated to your observation, I noticed quite a few warnings similar to "_no address range available for DHCP request via_ " in your debug log.

While those are harmless (unless you'd want to have Pi-hole's DHCP server to provide DHCP to those interfaces), you could consider explicitly configuring your Pi-hole container for your host's `ovs_eth0` by setting its [**`INTERFACE`**](https://github.com/pi-hole/docker-pi-hole#advanced-variables) environment variable accordingly, and setting **`DNSMASQ_LISTENING`** to `single`.

---

<div class="post-metadata">

**Author:** ![indigodelta](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/i/d26b3c/32.png) [@indigodelta](https://discourse.pi-hole.net/u/indigodelta)\
**Post date:** [March 15, 2024, 8:58am UTC](https://discourse.pi-hole.net/t/pihole-seems-to-be-redirecting-all-local-dns-to-the-internet/68934/19 "2024-03-15T08:58:45Z")

</div>

Thank you for your really helpful response. I've applied the local=/home/ option now and I think it's fixed it. Below is an exceprt of my log file, which no longer shows DNS requests for my local network resources being sent to the upstream DNS. Pihole receives the HTTPS query and responds with an NXDOMAIN reply, which seems like the correct behaviour given what you said previously. Does this now look OK to you?

```auto
Mar 15 09:19:40: query[A] pm.home from 192.168.1.245
Mar 15 09:19:40: /etc/pihole/custom.list pm.home is 192.168.1.4
Mar 15 09:19:40: query[HTTPS] _8006._https.pm.home from 192.168.1.245
Mar 15 09:19:40: config _8006._https.pm.home is NXDOMAIN

```

This "local" setting seems to be really important from a privacy perspective to prevent local DNS requests spilling out onto the internet. It wasn't obvious to me from the documentation that I needed to do this, and others might also have the same problem and not realise it unless they inspect their logs, so perhaps a really prominent paragraph in the documentation would be good, or a step-by-step guide on how to configure DNS and DHCP properly.

Thanks also for your advice regarding the warnings in the log. I'll test that later when nobody is using the network.

Thanks again for your support.

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [March 15, 2024, 7:37pm UTC](https://discourse.pi-hole.net/t/pihole-seems-to-be-redirecting-all-local-dns-to-the-internet/68934/20 "2024-03-15T19:37:59Z")

</div>

> [@indigodelta](#):
>
> This "local" setting seems to be really important from a privacy perspective to prevent local DNS requests spilling out onto the internet.

This will be handled better in the future, we already have a pull request awaiting review for the currently running Pi-hole v6 public beta:

> <https://github.com/pi-hole/FTL/pull/1900>
>
> \# What does this implement/fix?
> 
> This PR adds two related commits:
> 
> \- We sho…uld only set \`local=/\<domain\>/\` if there is no conditional forwarding setting (v6 supports multiple reverse lookup servers), otherwise, this creates a harmless but nonetheless needlessly confusing configuration (ad46a1018a27b17e1320998743f08b90287e8059)
> \- If dns.domainNeeded is set, refuse to send plain domain queries (like \`laptop\`) upstream at all. (231a9853bdca5e4dfdbcde40ea17ec3cdcb7ec46)
> 
> \*\*Related issue or feature (if applicable):\*\* N/A
> 
> \*\*Pull request in \[docs\](https://github.com/pi-hole/docs) with documentation (if applicable):\*\* N/A
> 
> \---
> \*\*By submitting this pull request, I confirm the following:\*\* 
> 
> 1. I have read and understood the \[contributors guide\](https://docs.pi-hole.net/guides/github/contributing/), as well as this entire template. I understand which branch to base my commits and Pull Requests against. 
> 2. I have commented my proposed changes within the code.
> 3. I am willing to help maintain this change if there are issues with it later.
> 4. It is compatible with the \[EUPL 1.2 license\](https://opensource.org/licenses/EUPL-1.1)
> 5. I have squashed any insignificant commits. (\[\`git rebase\`\](http://gitready.com/advanced/2009/02/10/squashing-commits-with-rebase.html))
> 
> \## Checklist:
> 
> \- \[x\] The code change is tested and works locally.
> \- \[x\] I based my code and PRs against the repositories \`developmental\` branch.
> \- \[x\] I \[signed off\](https://docs.pi-hole.net/guides/github/how-to-signoff/) all commits. Pi-hole enforces the \[DCO\](https://docs.pi-hole.net/guides/github/dco/) for all contributions
> \- \[x\] I \[signed\](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits) all my commits. Pi-hole requires signatures to verify authorship
> \- \[x\] I have read the above and my PR is ready for review.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [April 7, 2024, 6:18pm UTC](https://discourse.pi-hole.net/t/pihole-seems-to-be-redirecting-all-local-dns-to-the-internet/68934/23 "2024-04-07T18:18:28Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.