The issue I am facing: Over night whitelisted domains are blocked by pi-hole with no changes
Details about my system: Linux ubuntu-server 6.8.0-146-generic #146-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 3 16:12:30 UTC 2026 x86_64 - Core v6.4.3 FTL v6.7.1 Web interface v6.6
What I have changed since installing Pi-hole: Had several issues with external Blocking when using DNS4EU Servers - specially with IoT devices (aqara, meross, my-strom)
This is not caused by Pi-hole. Your upstream DNS server is blocking.
The important word here is external.
When a query shows the status Blocked (external, NXRA) it means the query was allowed by Pi-hole and sent upstream, but then the upstream DNS server returned the query as blocked.
Solution:
Use a different upstream DNS server.
I had cloudflare dns, I had DNS4EU, the last DNS was google - I would not expect google to block the meross servers. It worked fine yesterday. I did no changes and suddenly over night it got blocked. I know that it is not pi-hole but the upstream - I wonder why google DNS should "over night" block a domain for IoT devices ( also aqara was affected).
I had that several times now. It workes for some days and the over night it is blocked. Then I change upstream DNS and it works ... and some days later again. I have that since about 2 months now.
From Pi-hole machine, what is the output of these commands?
dig mqtt-eu-4.meross.com
dig mqtt-eu-4.meross.com @<pihole_IP>
dig mqtt-eu-4.meross.com @8.8.8.8
Also, please upload a debug log and post just the token URL that is generated after the log is uploaded by running the following command from the Pi-hole host terminal:
sudo pihole -d
currently it is working - I switched DNS today morning from Google to Cloudflare and after some minutes back - and DNS resolving worked again.
Here the outputs:
~$ dig mqtt-eu-4.meross.com
; <<>> DiG 9.18.39-0ubuntu0.24.04.8-Ubuntu <<>> mqtt-eu-4.meross.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20916
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 3 (Stale Answer)
;; QUESTION SECTION:
;mqtt-eu-4.meross.com. IN A
;; ANSWER SECTION:
mqtt-eu-4.meross.com. 0 IN A 99.81.71.200
mqtt-eu-4.meross.com. 0 IN A 54.216.1.110
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Fri Oct 16 09:43:33 CEST 2026
;; MSG SIZE rcvd: 87
~$ dig mqtt-eu-4.meross.com 192.168.xx.xx
; <<>> DiG 9.18.39-0ubuntu0.24.04.8-Ubuntu <<>> mqtt-eu-4.meross.com 192.168.xx.xx
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9609
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;mqtt-eu-4.meross.com. IN A
;; ANSWER SECTION:
mqtt-eu-4.meross.com. 46 IN A 99.81.71.200
mqtt-eu-4.meross.com. 46 IN A 54.216.1.110
;; Query time: 1 msec
;; SERVER: 192.168.100.25#53(192.168.xx.xx) (UDP)
;; WHEN: Fri Oct 16 09:43:47 CEST 2026
;; MSG SIZE rcvd: 81
~$ dig mqtt-eu-4.meross.com 8.8.8.8
; <<>> DiG 9.18.39-0ubuntu0.24.04.8-Ubuntu <<>> mqtt-eu-4.meross.com 8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39193
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 2d5176732b8797cf (echoed)
;; QUESTION SECTION:
;mqtt-eu-4.meross.com. IN A
;; ANSWER SECTION:
mqtt-eu-4.meross.com. 42 IN A 99.81.71.200
mqtt-eu-4.meross.com. 42 IN A 54.216.1.110
;; Query time: 2 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Fri Oct 16 09:43:52 CEST 2026
;; MSG SIZE rcvd: 133
Here the debug: https://tricorder.pi-hole.net/orLOktmC/
Do you see any lines in the query logs that show the blocking?
zgrep -i nxra /var/log/pihole/pihole.log*