# Query Status:  Blocked (external, NXRA) - mqtt-eu-4.meross.com  - Google (ECS, DNSSEC)

**URL:** <https://discourse.pi-hole.net/t/query-status-blocked-external-nxra-mqtt-eu-4-meross-com-google-ecs-dnssec/87934>\
**Category:** Community Help\
**Created:** [October 16, 2026, 6:39am UTC](https://discourse.pi-hole.net/t/query-status-blocked-external-nxra-mqtt-eu-4-meross-com-google-ecs-dnssec/87934 "2026-10-16T06:39:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![markusruebe](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/markusruebe/32/56495_2.png) [@markusruebe](https://discourse.pi-hole.net/u/markusruebe)\
**Post date:** [October 16, 2026, 6:39am UTC](https://discourse.pi-hole.net/t/query-status-blocked-external-nxra-mqtt-eu-4-meross-com-google-ecs-dnssec/87934/1 "2026-10-16T06:39:38Z")

</div>

**The issue I am facing: Over night whitelisted domains are blocked by pi-hole with no changes**

**Details about my system:** Linux ubuntu-server 6.8.0-146-generic #146-Ubuntu SMP PREEMPT\_DYNAMIC Thu Sep 3 16:12:30 UTC 2026 x86\_64 **- Core** [v6.4.3](https://github.com/pi-hole/pi-hole/releases/v6.4.3) **FTL** [v6.7.1](https://github.com/pi-hole/FTL/releases/v6.7.1) **Web interface** [v6.6](https://github.com/pi-hole/web/releases/v6.6)

**What I have changed since installing Pi-hole: Had several issues with external Blocking when using DNS4EU Servers - specially with IoT devices (aqara, meross, my-strom)**

---

<div class="post-metadata">

**Author:** ![rdwebdesign](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rdwebdesign/32/51363_2.png) [@rdwebdesign](https://discourse.pi-hole.net/u/rdwebdesign)\
**Post date:** [October 16, 2026, 6:44am UTC](https://discourse.pi-hole.net/t/query-status-blocked-external-nxra-mqtt-eu-4-meross-com-google-ecs-dnssec/87934/2 "2026-10-16T06:44:22Z")

</div>

This is not caused by Pi-hole. Your upstream DNS server is blocking.

The important word here is `external`.

When a query shows the status `Blocked (external, NXRA)` it means the query **was allowed by Pi-hole and sent upstream** , but then the upstream DNS server returned the query as blocked.

> [@markusruebe](#):
>
> Had several issues with external Blocking when using DNS4EU Servers

**Solution:**  
Use a different upstream DNS server.

---

<div class="post-metadata">

**Author:** ![markusruebe](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/markusruebe/32/56495_2.png) [@markusruebe](https://discourse.pi-hole.net/u/markusruebe)\
**Post date:** [October 16, 2026, 7:02am UTC](https://discourse.pi-hole.net/t/query-status-blocked-external-nxra-mqtt-eu-4-meross-com-google-ecs-dnssec/87934/3 "2026-10-16T07:02:14Z")

</div>

I had cloudflare dns, I had DNS4EU, the last DNS was google - I would not expect google to block the meross servers. It worked fine yesterday. I did no changes and suddenly over night it got blocked. I know that it is not pi-hole but the upstream - I wonder why google DNS should "over night" block a domain for IoT devices ( also aqara was affected).

I had that several times now. It workes for some days and the over night it is blocked. Then I change upstream DNS and it works ... and some days later again. I have that since about 2 months now.

---

<div class="post-metadata">

**Author:** ![rdwebdesign](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rdwebdesign/32/51363_2.png) [@rdwebdesign](https://discourse.pi-hole.net/u/rdwebdesign)\
**Post date:** [October 16, 2026, 7:41am UTC](https://discourse.pi-hole.net/t/query-status-blocked-external-nxra-mqtt-eu-4-meross-com-google-ecs-dnssec/87934/4 "2026-10-16T07:41:17Z")

</div>

From Pi-hole machine, what is the output of these commands?

```auto
dig mqtt-eu-4.meross.com

dig mqtt-eu-4.meross.com @<pihole_IP> 

dig mqtt-eu-4.meross.com @8.8.8.8

```

Also, please upload a debug log and post **just the token URL** that is generated after the log is uploaded by running the following command from the Pi-hole host terminal:

```auto
sudo pihole -d

```

---

<div class="post-metadata">

**Author:** ![markusruebe](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/markusruebe/32/56495_2.png) [@markusruebe](https://discourse.pi-hole.net/u/markusruebe)\
**Post date:** [October 16, 2026, 7:48am UTC](https://discourse.pi-hole.net/t/query-status-blocked-external-nxra-mqtt-eu-4-meross-com-google-ecs-dnssec/87934/5 "2026-10-16T07:48:51Z")

</div>

currently it is working - I switched DNS today morning from Google to Cloudflare and after some minutes back - and DNS resolving worked again.  
Here the outputs:

```auto
~$ dig mqtt-eu-4.meross.com

; <<>> DiG 9.18.39-0ubuntu0.24.04.8-Ubuntu <<>> mqtt-eu-4.meross.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20916
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 3 (Stale Answer)
;; QUESTION SECTION:
;mqtt-eu-4.meross.com. IN	A

;; ANSWER SECTION:
mqtt-eu-4.meross.com.	0	IN	A	99.81.71.200
mqtt-eu-4.meross.com.	0	IN	A	54.216.1.110

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Fri Oct 16 09:43:33 CEST 2026
;; MSG SIZE rcvd: 87

```

```auto
~$ dig mqtt-eu-4.meross.com 192.168.xx.xx

; <<>> DiG 9.18.39-0ubuntu0.24.04.8-Ubuntu <<>> mqtt-eu-4.meross.com 192.168.xx.xx
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9609
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;mqtt-eu-4.meross.com. IN	A

;; ANSWER SECTION:
mqtt-eu-4.meross.com.	46	IN	A	99.81.71.200
mqtt-eu-4.meross.com.	46	IN	A	54.216.1.110

;; Query time: 1 msec
;; SERVER: 192.168.100.25#53(192.168.xx.xx) (UDP)
;; WHEN: Fri Oct 16 09:43:47 CEST 2026
;; MSG SIZE rcvd: 81

```

```auto
~$ dig mqtt-eu-4.meross.com 8.8.8.8

; <<>> DiG 9.18.39-0ubuntu0.24.04.8-Ubuntu <<>> mqtt-eu-4.meross.com 8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39193
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 2d5176732b8797cf (echoed)
;; QUESTION SECTION:
;mqtt-eu-4.meross.com. IN	A

;; ANSWER SECTION:
mqtt-eu-4.meross.com.	42	IN	A	99.81.71.200
mqtt-eu-4.meross.com.	42	IN	A	54.216.1.110

;; Query time: 2 msec
;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP)
;; WHEN: Fri Oct 16 09:43:52 CEST 2026
;; MSG SIZE rcvd: 133

```

Here the debug: [https://tricorder.pi-hole.net/orLOktmC/](https://tricorder.pi-hole.net/orLOktmC/)

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [October 16, 2026, 3:47pm UTC](https://discourse.pi-hole.net/t/query-status-blocked-external-nxra-mqtt-eu-4-meross-com-google-ecs-dnssec/87934/6 "2026-10-16T15:47:07Z")

</div>

Do you see any lines in the query logs that show the blocking?

`zgrep -i nxra /var/log/pihole/pihole.log*`