EDIT: Who/what is that
172.18.0.1
IP thats making those queries?
It's wireguard container. I don't see these NS dot enteries if I that container is stopped
Logs (after starting wireguard container):
Sep 19 20:55:07 dnsmasq[332]: Pi-hole hostname pi.hole is 192.168.50.11
Sep 19 20:55:08 dnsmasq[332]: query[NS] . from 172.18.0.1
Sep 19 20:55:08 dnsmasq[332]: forwarded . to 192.168.50.1
Sep 19 20:55:08 dnsmasq[332]: reply . is NODATA
Sep 19 20:55:10 dnsmasq[332]: query[NS] . from 172.18.0.1
Sep 19 20:55:10 dnsmasq[332]: forwarded . to 192.168.50.1
Sep 19 20:55:10 dnsmasq[332]: reply . is NODATA
Sep 19 20:55:11 dnsmasq[332]: query[NS] . from 172.18.0.1
Sep 19 20:55:11 dnsmasq[332]: forwarded . to 192.168.50.1
Sep 19 20:55:11 dnsmasq[332]: reply . is NODATA