some clients just bypass the blocl list

Firefox has it's own name resolving built it. Unless you configure it not to, Firefox will use that. See this thread: How are some websites able to bypass Pi Hole?