# Problem with regex?

**URL:** <https://discourse.pi-hole.net/t/problem-with-regex/26747>\
**Category:** Help\
**Created:** [January 9, 2020, 9:53am UTC](https://discourse.pi-hole.net/t/problem-with-regex/26747 "2020-01-09T09:53:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [January 9, 2020, 9:53am UTC](https://discourse.pi-hole.net/t/problem-with-regex/26747/1 "2020-01-09T09:53:04Z")

</div>

**Pi-hole Version** v4.3.2 **Web Interface Version** v4.3.2 **FTL Version** v4.3.1

using the regex [list](https://raw.githubusercontent.com/mmotti/pihole-regex/master/regex.list) from @mmotti, which contains

```auto
^track(ers?|ing)?[0-9]*[-.]

```

however, in the pihole log, I find `tracker.coppersurfer.tk` (forwarded to unbound)

```auto
Jan 8 09:42:52 dnsmasq[23277]: query[TXT] tracker.coppersurfer.tk from 192.168.2.227
Jan 8 09:42:52 dnsmasq[23277]: forwarded tracker.coppersurfer.tk to 127.10.10.2
Jan 8 09:42:52 dnsmasq[23277]: forwarded tracker.coppersurfer.tk to fdaa:bbcc:ddee:2::5552
Jan 8 09:42:56 dnsmasq[23277]: query[TXT] tracker.coppersurfer.tk from 192.168.2.227
Jan 8 09:42:56 dnsmasq[23277]: forwarded tracker.coppersurfer.tk to 127.10.10.2
Jan 8 09:42:56 dnsmasq[23277]: forwarded tracker.coppersurfer.tk to fdaa:bbcc:ddee:2::5552

```

and in the unbound log, I find

```auto
Jan 08 09:42:49 unbound[5655:2] info: resolving tracker.coppersurfer.tk. TXT IN

```

because I also use SURICATA on my firewall (pfsense), unbound never gets a response (which is what I want)

 ![image](https://discourse.pi-hole.net/uploads/default/original/2X/7/750861fc4521da8f99377cd155289ac06389b439.png)

but the question remains, **why was it forwarded by pihole in the first place?** , the [manual](https://docs.pi-hole.net/ftldns/regex/tutorial/) says:

```auto
^abc
matches any domain starting (^) in "abc" like abcdomain.com, abc.domain.com but not def.abc.com

```

Does this have something to do with `query[TXT]`?

`edit`  
when I simply dig the domain, I get the expected result (0.0.0.0)

```auto
dig tracker.coppersurfer.tk

; <<>> DiG 9.11.5-P4-5.1-Raspbian <<>> tracker.coppersurfer.tk
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42590
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;tracker.coppersurfer.tk. IN A

;; ANSWER SECTION:
tracker.coppersurfer.tk. 2 IN A 0.0.0.0

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Jan 09 11:12:31 CET 2020
;; MSG SIZE rcvd: 68

```

`/edit`

Thank you for your time and effort.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [January 9, 2020, 10:21am UTC](https://discourse.pi-hole.net/t/problem-with-regex/26747/2 "2020-01-09T10:21:44Z")

</div>

> [@jpgpi250](#):
>
> Does this have something to do with `query[TXT]` ?

Yes. Pi-Hole only blocks A and AAAA queries.

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [January 9, 2020, 4:56pm UTC](https://discourse.pi-hole.net/t/problem-with-regex/26747/3 "2020-01-09T16:56:32Z")

</div>

@anon55913113, @DL6ER

In the [cname topic](https://discourse.pi-hole.net/t/apply-pi-hole-blocking-to-cnames/25445), @anon55913113 presented a [script](https://discourse.pi-hole.net/t/apply-pi-hole-blocking-to-cnames/25445/71) to create dummy zone files to block resolving, using unbound.

- Would this technique be useful to block the TXT queries?
- What would be the unbound files, configuration, needed to effectively block `tracker.coppersurfer.tk`?
- Alternatively, would it be possible to block the domain, using a dnsmasq `txt-record` (see [man](http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html) page)? How would such a dummy `txt-record` look like?

Thanks for your time and effort.

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [January 9, 2020, 5:25pm UTC](https://discourse.pi-hole.net/t/problem-with-regex/26747/4 "2020-01-09T17:25:38Z")

</div>

The current `development` version already blocks all types of requests so you won't need to do anything in addition.  
FTL v4.x blocks only `A` and `AAAA` as mentioned by @jfb.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [January 30, 2020, 5:25pm UTC](https://discourse.pi-hole.net/t/problem-with-regex/26747/5 "2020-01-30T17:25:39Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.