# Remove 150 concurrent DNS queries to bypass digital ID

**URL:** <https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657>\
**Category:** Help\
**Created:** [April 6, 2026, 6:25am UTC](https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657 "2026-04-06T06:25:33Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![Whisky](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/whisky/32/43974_2.png) [@Whisky](https://discourse.pi-hole.net/u/Whisky)\
**Post date:** [April 6, 2026, 6:25am UTC](https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657/1 "2026-04-06T06:25:33Z")

</div>

## Context

I have created similar topic in the past but it got nowhere, this is a serious problem now coz of digital ID bs, and I am hoping to have a different outcome: [Maximum number of concurrent DNS queries reached (max: 150)](https://discourse.pi-hole.net/t/maximum-number-of-concurrent-dns-queries-reached-max-150/56797)

## Expected Behaviour:

Process non-blocked DNS requests no matter what.

## Actual Behaviour:

With countries going with this “protect the kids” nonsense, websites and even posts on X no longer load unless you provide a document to identify yourself. Suuuuuuuuuuure.

The workaround assuming you run OPNSense or anything alike it:

1. Setup VPN like Proton/Mullvad
2. Create firewall aliases that resolve DNS like so [https://raw.githubusercontent.com/antonme/ipnames/refs/heads/master/dns-twitter.txt](https://raw.githubusercontent.com/antonme/ipnames/refs/heads/master/dns-twitter.txt)
3. Create NAT firewall rule that identify when you are trying to access x[.]com and forward the request from any of those DNS via the VPN instead of your home WAN
4. Voila 🙂

dns-twitter.txt has over 200 DNS entrances meaning, as soon as it is added to OPNSense, it tries to resolve them to create a URL Tables (IPs).

Pihole poops the bed and crash because of its 150 concurrent DNS queries.

The few queries it process, posts that required ID before, start working just fine but then everything goes down.

I have been running Pihole + Unbound recursive DNS since forever (its local DNS for all the Proxmox containers is really something else) and this 150 concurrent DNS queries always gave me hell coz of my Samsung smartTV.

But now this is a serious problem, and I am hopping to have a happier ending this time.

## Pihole Setup

Is there any flag, anything I can add in here during installation to remove this 150 restriction?

I don’t mind If I have to reinstall it coz it is automated, otherwise, I will have to abandon Pihole after all these years. I am not having this digital ID crappy for real.

Thanks a ton

```yaml
  - name: Copy config files to LXC container
    ansible.builtin.command: >
      pct push {{ lxc_id }} {{ item.src }} {{ item.dest }}
    loop:
      - { src: '/tmp/99-pihole.conf', dest: '/etc/sysctl.d/99-custom.conf' }
      - { src: '/tmp/pihole.toml', dest: '/etc/pihole/pihole.toml' }
      - { src: '/tmp/adlist.sql', dest: '/tmp/adlist.sql' }

  - name: Install Pi-Hole
    ansible.builtin.command: >
     pct exec {{ lxc_id }} -- bash -c "
     curl -sSL https://install.pi-hole.net | sudo -E bash /dev/stdin --unattended;
     "

  - name: Import lists and hotfixes
    ansible.builtin.command: >
     pct exec {{ lxc_id }} -- bash -c "
     pihole-FTL --config ntp.sync.interval 0;
     systemctl stop pihole-FTL;
     sqlite3 /etc/pihole/gravity.db < /tmp/adlist.sql;
     systemctl start pihole-FTL;
     sudo pihole -g
     "

```

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [April 6, 2026, 7:52am UTC](https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657/2 "2026-04-06T07:52:02Z")

</div>

> [@Whisky](#):
>
> - Setup VPN like Proton/Mullvad
> - Create firewall aliases that resolve DNS like so [https://raw.githubusercontent.com/antonme/ipnames/refs/heads/master/dns-twitter.txt](https://raw.githubusercontent.com/antonme/ipnames/refs/heads/master/dns-twitter.txt)
> - Create NAT firewall rule that identify when you are trying to access x[.]com and forward the request from any of those DNS via the VPN instead of your home WAN

I don't see how that would trigger a max concurrency warning in Pi-hole.

It seems your router is sending DNS requests for domains contained in dns-twitter.txt to Pi-hole? Does Pi-hole send those DNS requests back to your router?

Please upload a debug log and post **just the token URL** that is generated after the log is uploaded by running the following command from the Pi-hole host terminal:

```auto
sudo pihole -d

```

or if you run your Pi-hole as a Docker container:

```auto
docker exec -it <pihole-container-name-or-id> pihole -d

```

where you substitute `<pihole-container-name-or-id>` as required.

---

<div class="post-metadata">

**Author:** ![smokingwheels](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/smokingwheels/32/2029_2.png) [@smokingwheels](https://discourse.pi-hole.net/u/smokingwheels)\
**Post date:** [April 6, 2026, 11:13am UTC](https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657/3 "2026-04-06T11:13:40Z")

</div>

You’ve basically created a DNS burst storm — OPNSense resolving a couple hundred domains at once will smash Pi-hole pretty hard. It’s great for normal use, but not big spikes like that, especially with Unbound underneath doing extra work.

If you’re on **Proxmox** , honestly the easiest fix is just spin up another Pi-hole and spread the load between with a **dnsdist** server across the two, rather than hammering a single Pi-hole.

Nothing wrong with what you’re doing — just pushing it a bit harder than Pi-hole likes 👍

---

<div class="post-metadata">

**Author:** ![nero355](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/nero355/32/54774_2.png) [@nero355](https://discourse.pi-hole.net/u/nero355)\
**Post date:** [April 6, 2026, 1:57pm UTC](https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657/4 "2026-04-06T13:57:18Z")

</div>

It’s a normal OPNsense thing, because like he says :

> [@Whisky](#):
>
> dns-twitter.txt has over 200 DNS entrances meaning, as soon as it is added to OPNSense, it tries to resolve them to create a URL Tables (IPs).

It’s basically a conversion that takes place once in a while to update the Alias used in the Firewall Rule which contains all the needed data 😉

---

<div class="post-metadata">

**Author:** ![sawsanders](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/76d3ee/32.png) [@sawsanders](https://discourse.pi-hole.net/u/sawsanders)\
**Post date:** [April 6, 2026, 5:00pm UTC](https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657/5 "2026-04-06T17:00:59Z")

</div>

Why not put `dns-forward-max=somelargenumber` in `misc.dnsmasq_lines`?

---

<div class="post-metadata">

**Author:** ![nero355](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/nero355/32/54774_2.png) [@nero355](https://discourse.pi-hole.net/u/nero355)\
**Post date:** [April 6, 2026, 5:10pm UTC](https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657/6 "2026-04-06T17:10:24Z")

</div>

Thanks for reminding me!

Now I know where I have seen that setting the last couple of days : [https://linux.die.net/man/8/dnsmasq](https://linux.die.net/man/8/dnsmasq)

> **-0, --dns-forward-max=**
> 
> Set the maximum number of concurrent DNS queries. The default value is 150, which should be fine for most setups. The only known situation where this needs to be increased is when using web-server log file resolvers, which can generate large numbers of concurrent queries.

😬👍👍

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [April 6, 2026, 8:56pm UTC](https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657/7 "2026-04-06T20:56:59Z")

</div>

> [@sawsanders](#):
>
> dns-forward-max=somelargenumber

That would be the way to lift Pi-hole's default concurrent connection pool size.  
BUT:

> **I'd recommend to investigate the trigger conditions prior to considering changing that value (click for details).**
>
> If the trigger condition could be controlled, doing so would be superior to just sacrifing more resources.
> 
> And even if it can't be controlled, I'd advise to increase that value with caution.  
> Routers may employ stateful firewalls, which may not be able to cope with a prolongued burst of unlimited UDP requests, which in turn may cause it to drop packets or even to lock up completely (my own router reboots in mid-operation when pushed over a certain threshold).
> 
> @Whisky's linked `dns-twitter.txt` currently contains 236 domains, which may prompt 236 `A` record requests from their router, and perhaps another 236 requests for `AAAA` records.  
> Running isolated tests with a single client query rates of 236 qps, 472 qps and 942 qps using `dns-twitter.txt`, I wasn't able to trigger a max concurreny warning.  
> And when raising query rates to 1,000qps, Pi-hole's rate limiting kicked in - before a max concurrency warning was triggered.
> 
> Those tests would suggest that the router by itself is not likely to trigger a max concurrency warning.  
> What those isolated tests don't account for are other factors like DNS loops or a very busy network - those may well tip the balance to saturate and exceed Pi-hole's concurrent connection pool.

If a DNS loop would be involved, that should be removed, regardless how much it would actually contribute to Whisky's observation.

But there's another thing to consider:  
My tests revealed that in my case, quite a few of the `dns-twitter.txt` domains were blocked by Pi-hole, e.g. `startup.mobile.yandex.net` (by Pi-hole's default list), `syndication.twitter.com` (by one of my custom blocklists) or `twitter-verificationsupport.xn--55qx5d.cn` (by a custom regex).

The point here is that  
a. you want all of those domains to resolve, so your router can handle their respective IPs  
b. you don't want your router to block or reroute whatever IP your Pi-hole is configured to reply for a blocked domain

For b. in particular, you may trigger unintended side effects, e.g. Pi-hole's default `0.0.0.0` reply -when used without sanity checks- could be misinterpreted by your firewall as pointing to the firewall itself.

Therefore, I'd recommend a different approach to tackle Whisky's issue:  
If possible, you should send DNS requests for domains from `dns-twitter.txt` to a non-filtering, public DNS server instead of your Pi-hole.  
This should guarantee your router receives the correct IPs, and also prevent it from triggering Pi-hole's max concurrency limit.

---

<div class="post-metadata">

**Author:** ![Whisky](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/whisky/32/43974_2.png) [@Whisky](https://discourse.pi-hole.net/u/Whisky)\
**Post date:** [April 6, 2026, 11:36pm UTC](https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657/8 "2026-04-06T23:36:46Z")

</div>

> [@sawsanders](#):
>
> Why not put `dns-forward-max=somelargenumber` in `misc.dnsmasq_lines`?

How I wished this existed years ago!!  
You have no idea how many dozens of time my whole home network would go down even during WFH because of my Samsung SmartTV so yeah, I have had a hate and love relationship with Pihole because of this limit since forever.

IMHO, no tool or service should have such options hidden, IIRC, Miscellaneous is new feature released with V6.

Oh well…

> [@Bucking\_Horn](#):
>
> Therefore, I'd recommend a different approach to tackle Whisky's issue:  
> If possible, you should send DNS requests for domains from `dns-twitter.txt` to a non-filtering, public DNS server instead of your Pi-hole.  
> This should guarantee your router receives the correct IPs, and also prevent it from triggering Pi-hole's max concurrency limit.

OPNSense blocks any public DNS, any DoT, any DoH.

1. Only Piholes + Unbound (same LXC container) can go out to request DNS
2. If you set `8.8.8.8` or `8.8.8.8:443` on your phone, OPNSense firewall rules detects that and forces it back into Pihole
3. Nobody can bypass that, all because my Samsung smartTV has Google DNS hardcoded
4. I prefer to keep Unbound Recursive DNS to do what it does, I don’t wanna touch public DNS

Even tho the post is flagged as Solved, I will keep updating it as go.

Like I said, this problem gave me so much hell that I only went back to Pihole coz of its mDNS, I don’t wish anybody to have the hell I have had because of this enforced limitation.  
Hopefully somebody can find this post someday.

Thank you all for all the help and support 🙂

---

<div class="post-metadata">

**Author:** ![rdwebdesign](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rdwebdesign/32/51363_2.png) [@rdwebdesign](https://discourse.pi-hole.net/u/rdwebdesign)\
**Post date:** [April 7, 2026, 12:45am UTC](https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657/9 "2026-04-07T00:45:11Z")

</div>

Note about `dns-forward-max`:

> [@Whisky](#):
>
> How I wished this existed years ago!!  
> (...)  
> IMHO, no tool or service should have such options hidden (...)

This option was never hidden. Users could always change it, but it was always considered a `dnsmasq` advanced option.

Pi-hole (including all previous versions) was able to use `dns-forward-max` option by adding a config file, [as shown on this old post](https://discourse.pi-hole.net/t/need-to-get-plex-working-with-pihole/20487).

> [@Whisky](#):
>
> Miscellaneous is new feature released with V6.

That's the new part _(since Pi-hole v6)_.

Now, besides using the old method (using additional config files) you can also use `misc.dnsmasq_lines` to add a few configuration lines.

---

<div class="post-metadata">

**Author:** ![Whisky](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/whisky/32/43974_2.png) [@Whisky](https://discourse.pi-hole.net/u/Whisky)\
**Post date:** [April 7, 2026, 1:27am UTC](https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657/10 "2026-04-07T01:27:52Z")

</div>

> [@rdwebdesign](#):
>
> This option was never hidden. Users could always change it, but it was always considered a `dnsmasq` advanced option.

This was never made public.

I have asked this before and I always kept getting the same answer, 150 is it if you like it or not.

You will find post after post here, Reddit, you name it, my post back in 2024 with this same problem and there is no response other than the usual “150 is it”

Seeing how important this feature is, it should not be this obscure.

Moving everything to OPNSense Unbound + blocklist, is not longer a problem.  
But I prefer to have a dedicated DNS setup.

> [@sawsanders](#):
>
> Why not put `dns-forward-max=somelargenumber` in `misc.dnsmasq_lines`?

Thank you so much for this.

I have set it to 400, OPNSense can process the whole list now, there are no more Errors, Pihole instances no longer die taking the whole goddamn network down with it as usual.

`resolving 256 hostnames (143 addresses) for DNS_Twitter took 17.91 seconds`

When accessing x[.]com, OPNSense Mullvad VPN is the one processing all the requests, everything else goes via WAN.

Anyway, I am thankful to finally find a solution for this, and bitter coz of all the hell I had due to this limit when the solution was this ridiculous simple and yet not made available properly.

I am not a DNS expert, I would never have looked into `dnsmasq` which Pihole uses to do its thing. I would expect this to be set on Pihole level for obvious reasons.

So yeah, I am pissed, I am gonna touch some grass.

Thank you all

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [April 7, 2026, 5:38am UTC](https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657/13 "2026-04-07T05:38:19Z")

</div>

> [@Whisky](#):
>
> I only went back to Pihole coz of its mDNS

Pi-hole isn't involved with mDNS at all.  
[mDNS](https://en.wikipedia.org/wiki/Multicast_DNS) is a distinctively different protocol, using different ports, negotiating names with same-link peers instead of a server.

> [@Whisky](#):
>
> How I wished this existed years ago!!

> [@Whisky](#):
>
> You will find post after post here, Reddit, you name it, my post back in 2024 with this same problem and there is no response other than the usual “150 is it”

Check your bookmarks - you have been given that information years ago.  
The following is quoting answers from the topic you created in 2024:

> [@150 RATE LIMIT is driving me nuts](https://discourse.pi-hole.net/t/150-rate-limit-is-driving-me-nuts/73757/2):
>
> put `dns-forward-max=xxxx` (where xxxx is the limit you want) in the config file on the Pi-hole system.
> 
> But if the internet is down, it'll probably reach the new limit again anyway.

> [@150 RATE LIMIT is driving me nuts](https://discourse.pi-hole.net/t/150-rate-limit-is-driving-me-nuts/73757/4):
>
> And you can find the `dnsmasq` options in **DNSMASQ man page** :
> 
> - [Man page of DNSMASQ](https://thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html)

> [@150 RATE LIMIT is driving me nuts](https://discourse.pi-hole.net/t/150-rate-limit-is-driving-me-nuts/73757/5):
>
> Sweet, I have bookmarked those.

---

<div class="post-metadata">

**Author:** ![Whisky](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/whisky/32/43974_2.png) [@Whisky](https://discourse.pi-hole.net/u/Whisky)\
**Post date:** [April 7, 2026, 6:38am UTC](https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657/15 "2026-04-07T06:38:20Z")

</div>

> [@Bucking\_Horn](#):
>
> Check your bookmarks - you have been given that information years ago:

Something wrong is not right, I replied with:

`I didn't know I could increase that which I am doing now!!!!`

But the problem was never solved, not until I followed sawsanders suggestion, and it worked right away.  
Have I made a noob mistake back then??  
It is possible.

> [@Bucking\_Horn](#):
>
> Pi-hole isn't involved with mDNS at all.  
> [mDNS](https://en.wikipedia.org/wiki/Multicast_DNS) is a distinctively different protocol, using different ports, negotiating names with same-link peers instead of a server.

Pihole makes things simpler, and it just works so why I wanted to give this drama one last try before trying something else.

Technitium DNS Server requires a zone to be created and then point `10.19.0.10` to `jellyfin.home.arpa` within that zone with some extra flags.

Coz of going all in into hosting my stuff/homelab, I started exploring Pihole more than just AD blocking.  
”It is always DNS” is more and more no longer just a meme on the internet lmao

Thank you so much for the reply.

---

<div class="post-metadata">

**Author:** ![nero355](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/nero355/32/54774_2.png) [@nero355](https://discourse.pi-hole.net/u/nero355)\
**Post date:** [April 7, 2026, 2:40pm UTC](https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657/17 "2026-04-07T14:40:10Z")

</div>

**FYI =\>**

If you really need mDNS features then there are two main tools for your Linux/\*BSD devices :

- AVAHI : [https://en.wikipedia.org/wiki/Avahi\_(software)](https://en.wikipedia.org/wiki/Avahi%5C_(software))
- mDNS Proxy in this case also available on OPNsense : [Multicast DNS Proxy — OPNsense documentation](https://docs.opnsense.org/manual/how-tos/multicast-dns.html)

There might be others by now, but I think the above ones are the well known ones 🙂

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [April 30, 2026, 9:18pm UTC](https://discourse.pi-hole.net/t/remove-150-concurrent-dns-queries-to-bypass-digital-id/85657/21 "2026-04-30T21:18:46Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.