Expected Behaviour:
Running PiHole on a SBC running Ubuntu Server with DNS directed to Quad9. Has been running fine for over a year with regular testing.
Actual Behaviour:
DNS is going to Google servers with today's test
What test are you doing and where/how have you determined that Google is being used?
I use dnsleaktest.com and on.quad9.net
Funny thing is I've tested again this morning and everything is working fine. Because of that I cannot do any further diagnostics on the pihole or the router.
The log snips show that queries were forwarded only to one of the quad9 IPv4 addresses.
Sep 25 00:00:02 dnsmasq[1022]: forwarded <redacted> to 149.112.112.11
You could grep the /var/log/pihole/pihole.log for the word forwarded and see a list of the upstream DNS servers being used.
All forwards in the the logfile go to the IPv6 2620:fe::fe:10, which is quad9.
No redirection active on the router. The router itself also uses quad9.
edit
Further, the pihole GUI lists, other than blocklist and cache, dns10.quad9.net#53, 2620:fe::fe:10#53, 9.9.9.11#53, 149.112.112.11#53 and 2620:fe::10#53
I don't see anything related to Google on those IPs and there aren't any processes that would use an IP and not list it.
Maybe there is something on the server itself? /etc/resolv.conf shows the DNS servers that the host will use for it's own resolution.