Some domains get NXDOMAIN

Help
1

I've been seaching the web and this forum for an answer and, I think, i have tried everything sugested or asked in here but i have some domains that even after flushing my dns aren't resolved.

one exemple is reddit.com

This is my pihole-FTL.log

[2021-10-27 18:11:47.188 7166M] Identifying interface (looking for 192.168.2.254):
[2021-10-27 18:11:47.188 7166M]   - IPv4 interface eth0 (2,0) is 192.168.2.254
[2021-10-27 18:11:47.188 7166M]     ^^^ MATCH ^^^
[2021-10-27 18:11:47.188 7166M] Analyzing interfaces:
[2021-10-27 18:11:47.188 7166M]   -  OK  IPv4 interface eth0 (2,0) is 192.168.2.254
[2021-10-27 18:11:47.188 7166M]   - SKIP IPv4 interface lo: (1,0) != (2,0)
[2021-10-27 18:11:47.188 7166M]   -  OK  IPv6 interface eth0 (2,0) is fe80::40f:43ff:fe60:fa56 (LL)
[2021-10-27 18:11:47.188 7166M]   - SKIP IPv6 interface lo: (1,0) != (2,0)
[2021-10-27 18:11:47.188 7166M] Processing FTL hook from src/dnsmasq/forward.c:1573...
[2021-10-27 18:11:47.188 7166M]      Flags: F_FORWARD F_IPV4 F_QUERY 
[2021-10-27 18:11:47.188 7166M] Waiting for SHM lock in _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:586)
[2021-10-27 18:11:47.188 7166M] Obtained SHM lock for _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:586)
[2021-10-27 18:11:47.188 7166M] **** new UDP IPv4 query[A] query "www.reddit.com" from eth0:192.168.1.106#59155 (ID 724, FTL 6827, src/dnsmasq/forward.c:1575)
[2021-10-27 18:11:47.188 7166M] getOverTimeID(1635354900): 145
[2021-10-27 18:11:47.188 7166M] Query 724: status unchanged: UNKNOWN (0) in src/dnsmasq_interface.c:695
[2021-10-27 18:11:47.188 7166M] Setting DNSSEC status to INSECURE in src/dnsmasq_interface.c:710
[2021-10-27 18:11:47.188 7166M] find_mac("192.168.1.106") returned 0 bytes of data
[2021-10-27 18:11:47.188 7166M] www.reddit.com is known as not to be blocked
[2021-10-27 18:11:47.188 7166M] Removed lock in _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:804)
[2021-10-27 18:11:47.188 7166M] Processing FTL hook from src/dnsmasq/rfc1035.c:1842...
[2021-10-27 18:11:47.189 7166M]      Flags: F_FORWARD F_NEG F_NXDOMAIN 
[2021-10-27 18:11:47.189 7166M] Waiting for SHM lock in FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:1857)
[2021-10-27 18:11:47.189 7166M] Obtained SHM lock for FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:1857)
[2021-10-27 18:11:47.189 7166M] **** got cache reply: www.reddit.com is (NXDOMAIN) (ID 724, src/dnsmasq/rfc1035.c:1842)
[2021-10-27 18:11:47.189 7166M] Query 724: status changed: UNKNOWN (0) -> CACHE (3) in src/dnsmasq_interface.c:2025
[2021-10-27 18:11:47.189 7166M] getOverTimeID(1635354900): 145
[2021-10-27 18:11:47.189 7166M] Set reply to NXDOMAIN (2) in src/dnsmasq_interface.c:2039
[2021-10-27 18:11:47.189 7166M] Setting DNSSEC status to INSECURE in src/dnsmasq_interface.c:2046
[2021-10-27 18:11:47.189 7166M] Removed lock in FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:2051)
[2021-10-27 18:11:47.337 7166M] Interfaces: Called from src/dnsmasq/forward.c:1545
[2021-10-27 18:11:47.337 7166M] Identifying interface (looking for 192.168.2.254):
[2021-10-27 18:11:47.337 7166M]   - IPv4 interface eth0 (2,0) is 192.168.2.254
[2021-10-27 18:11:47.337 7166M]     ^^^ MATCH ^^^
[2021-10-27 18:11:47.337 7166M] Analyzing interfaces:
[2021-10-27 18:11:47.337 7166M]   -  OK  IPv4 interface eth0 (2,0) is 192.168.2.254
[2021-10-27 18:11:47.337 7166M]   - SKIP IPv4 interface lo: (1,0) != (2,0)
[2021-10-27 18:11:47.337 7166M]   -  OK  IPv6 interface eth0 (2,0) is fe80::40f:43ff:fe60:fa56 (LL)
[2021-10-27 18:11:47.337 7166M]   - SKIP IPv6 interface lo: (1,0) != (2,0)
[2021-10-27 18:11:47.337 7166M] Processing FTL hook from src/dnsmasq/forward.c:1573...
[2021-10-27 18:11:47.337 7166M]      Flags: F_FORWARD F_IPV4 F_QUERY 
[2021-10-27 18:11:47.337 7166M] Waiting for SHM lock in _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:586)
[2021-10-27 18:11:47.337 7166M] Obtained SHM lock for _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:586)
[2021-10-27 18:11:47.337 7166M] **** new UDP IPv4 query[A] query "trace.svc.ui.com" from eth0:192.168.2.1#57927 (ID 725, FTL 6828, src/dnsmasq/forward.c:1575)
[2021-10-27 18:11:47.337 7166M] getOverTimeID(1635354900): 145
[2021-10-27 18:11:47.337 7166M] Query 725: status unchanged: UNKNOWN (0) in src/dnsmasq_interface.c:695
[2021-10-27 18:11:47.337 7166M] Setting DNSSEC status to INSECURE in src/dnsmasq_interface.c:710
[2021-10-27 18:11:47.338 7166M] trace.svc.ui.com is known as gravity blocked
[2021-10-27 18:11:47.338 7166M] Query 725: status changed: UNKNOWN (0) -> GRAVITY (1) in src/dnsmasq_interface.c:2288
[2021-10-27 18:11:47.338 7166M] getOverTimeID(1635354900): 145
[2021-10-27 18:11:47.338 7166M] Removed lock in _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:804)
[2021-10-27 18:11:47.338 7166M] Preparing reply for "trace.svc.ui.com", EDE: N/A
[2021-10-27 18:11:47.338 7166M]      Flags: F_IPV4 
[2021-10-27 18:11:47.338 7166M]   Adding RR: "trace.svc.ui.com A 0.0.0.0"
[2021-10-27 18:11:47.338 7166M] Processing FTL hook from src/dnsmasq_interface.c:347...
[2021-10-27 18:11:47.338 7166M]      Flags: F_HOSTS F_IPV4 
[2021-10-27 18:11:47.338 7166M] Waiting for SHM lock in FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:1857)
[2021-10-27 18:11:47.338 7166M] Obtained SHM lock for FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:1857)
[2021-10-27 18:11:47.338 7166M] **** got cache reply: trace.svc.ui.com is 0.0.0.0 (ID 725, src/dnsmasq_interface.c:347)
[2021-10-27 18:11:47.338 7166M] Skipping detection of external blocking IP for ID 725 as origin is HOSTS
[2021-10-27 18:11:47.338 7166M] Set reply to IP (4) in src/dnsmasq_interface.c:2039
[2021-10-27 18:11:47.338 7166M] Setting DNSSEC status to INSECURE in src/dnsmasq_interface.c:2046
[2021-10-27 18:11:47.338 7166M] Removed lock in FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:2051)
[2021-10-27 18:11:47.338 7166M] Interfaces: Called from src/dnsmasq/forward.c:1545
[2021-10-27 18:11:47.338 7166M] Identifying interface (looking for 192.168.2.254):
[2021-10-27 18:11:47.338 7166M]   - IPv4 interface eth0 (2,0) is 192.168.2.254
[2021-10-27 18:11:47.338 7166M]     ^^^ MATCH ^^^
[2021-10-27 18:11:47.338 7166M] Analyzing interfaces:
[2021-10-27 18:11:47.338 7166M]   -  OK  IPv4 interface eth0 (2,0) is 192.168.2.254
[2021-10-27 18:11:47.338 7166M]   - SKIP IPv4 interface lo: (1,0) != (2,0)
[2021-10-27 18:11:47.338 7166M]   -  OK  IPv6 interface eth0 (2,0) is fe80::40f:43ff:fe60:fa56 (LL)
[2021-10-27 18:11:47.338 7166M]   - SKIP IPv6 interface lo: (1,0) != (2,0)
[2021-10-27 18:11:47.338 7166M] Processing FTL hook from src/dnsmasq/forward.c:1573...
[2021-10-27 18:11:47.338 7166M]      Flags: F_FORWARD F_IPV4 F_QUERY 
[2021-10-27 18:11:47.338 7166M] Waiting for SHM lock in _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:586)
[2021-10-27 18:11:47.338 7166M] Obtained SHM lock for _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:586)
[2021-10-27 18:11:47.338 7166M] **** new UDP IPv4 query[AAAA] query "trace.svc.ui.com" from eth0:192.168.2.1#53238 (ID 726, FTL 6829, src/dnsmasq/forward.c:1575)
[2021-10-27 18:11:47.338 7166M] getOverTimeID(1635354900): 145
[2021-10-27 18:11:47.338 7166M] Query 726: status unchanged: UNKNOWN (0) in src/dnsmasq_interface.c:695
[2021-10-27 18:11:47.338 7166M] Setting DNSSEC status to INSECURE in src/dnsmasq_interface.c:710
[2021-10-27 18:11:47.338 7166M] trace.svc.ui.com is known as gravity blocked
[2021-10-27 18:11:47.338 7166M] Query 726: status changed: UNKNOWN (0) -> GRAVITY (1) in src/dnsmasq_interface.c:2288
[2021-10-27 18:11:47.338 7166M] getOverTimeID(1635354900): 145
[2021-10-27 18:11:47.338 7166M] Removed lock in _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:804)
[2021-10-27 18:11:47.338 7166M] Preparing reply for "trace.svc.ui.com", EDE: N/A
[2021-10-27 18:11:47.338 7166M]      Flags: F_IPV6 
[2021-10-27 18:11:47.338 7166M]   Adding RR: "trace.svc.ui.com AAAA ::"
[2021-10-27 18:11:47.338 7166M] Processing FTL hook from src/dnsmasq_interface.c:375...
[2021-10-27 18:11:47.338 7166M]      Flags: F_HOSTS F_IPV6 
[2021-10-27 18:11:47.338 7166M] Waiting for SHM lock in FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:1857)
[2021-10-27 18:11:47.338 7166M] Obtained SHM lock for FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:1857)
[2021-10-27 18:11:47.338 7166M] **** got cache reply: trace.svc.ui.com is :: (ID 726, src/dnsmasq_interface.c:375)
[2021-10-27 18:11:47.338 7166M] Skipping detection of external blocking IP for ID 726 as origin is HOSTS
[2021-10-27 18:11:47.338 7166M] Set reply to IP (4) in src/dnsmasq_interface.c:2039
[2021-10-27 18:11:47.338 7166M] Setting DNSSEC status to INSECURE in src/dnsmasq_interface.c:2046
[2021-10-27 18:11:47.338 7166M] Removed lock in FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:2051)```

and this are my pihole.log

[2021-10-27 18:11:47.188 7166M] Interfaces: Called from src/dnsmasq/forward.c:1545
[2021-10-27 18:11:47.188 7166M] Identifying interface (looking for 192.168.2.254):
[2021-10-27 18:11:47.188 7166M]   - IPv4 interface eth0 (2,0) is 192.168.2.254
[2021-10-27 18:11:47.188 7166M]     ^^^ MATCH ^^^
[2021-10-27 18:11:47.188 7166M] Analyzing interfaces:
[2021-10-27 18:11:47.188 7166M]   -  OK  IPv4 interface eth0 (2,0) is 192.168.2.254
[2021-10-27 18:11:47.188 7166M]   - SKIP IPv4 interface lo: (1,0) != (2,0)
[2021-10-27 18:11:47.188 7166M]   -  OK  IPv6 interface eth0 (2,0) is fe80::40f:43ff:fe60:fa56 (LL)
[2021-10-27 18:11:47.188 7166M]   - SKIP IPv6 interface lo: (1,0) != (2,0)
[2021-10-27 18:11:47.188 7166M] Processing FTL hook from src/dnsmasq/forward.c:1573...
[2021-10-27 18:11:47.188 7166M]      Flags: F_FORWARD F_IPV4 F_QUERY 
[2021-10-27 18:11:47.188 7166M] Waiting for SHM lock in _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:586)
[2021-10-27 18:11:47.188 7166M] Obtained SHM lock for _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:586)
[2021-10-27 18:11:47.188 7166M] **** new UDP IPv4 query[A] query "www.reddit.com" from eth0:192.168.1.106#59155 (ID 724, FTL 6827, src/dnsmasq/forward.c:1575)
[2021-10-27 18:11:47.188 7166M] getOverTimeID(1635354900): 145
[2021-10-27 18:11:47.188 7166M] Query 724: status unchanged: UNKNOWN (0) in src/dnsmasq_interface.c:695
[2021-10-27 18:11:47.188 7166M] Setting DNSSEC status to INSECURE in src/dnsmasq_interface.c:710
[2021-10-27 18:11:47.188 7166M] find_mac("192.168.1.106") returned 0 bytes of data
[2021-10-27 18:11:47.188 7166M] www.reddit.com is known as not to be blocked
[2021-10-27 18:11:47.188 7166M] Removed lock in _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:804)
[2021-10-27 18:11:47.188 7166M] Processing FTL hook from src/dnsmasq/rfc1035.c:1842...
[2021-10-27 18:11:47.189 7166M]      Flags: F_FORWARD F_NEG F_NXDOMAIN 
[2021-10-27 18:11:47.189 7166M] Waiting for SHM lock in FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:1857)
[2021-10-27 18:11:47.189 7166M] Obtained SHM lock for FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:1857)
[2021-10-27 18:11:47.189 7166M] **** got cache reply: www.reddit.com is (NXDOMAIN) (ID 724, src/dnsmasq/rfc1035.c:1842)
[2021-10-27 18:11:47.189 7166M] Query 724: status changed: UNKNOWN (0) -> CACHE (3) in src/dnsmasq_interface.c:2025
[2021-10-27 18:11:47.189 7166M] getOverTimeID(1635354900): 145
[2021-10-27 18:11:47.189 7166M] Set reply to NXDOMAIN (2) in src/dnsmasq_interface.c:2039
[2021-10-27 18:11:47.189 7166M] Setting DNSSEC status to INSECURE in src/dnsmasq_interface.c:2046
[2021-10-27 18:11:47.189 7166M] Removed lock in FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:2051)
[2021-10-27 18:11:47.337 7166M] Interfaces: Called from src/dnsmasq/forward.c:1545
[2021-10-27 18:11:47.337 7166M] Identifying interface (looking for 192.168.2.254):
[2021-10-27 18:11:47.337 7166M]   - IPv4 interface eth0 (2,0) is 192.168.2.254
[2021-10-27 18:11:47.337 7166M]     ^^^ MATCH ^^^
[2021-10-27 18:11:47.337 7166M] Analyzing interfaces:
[2021-10-27 18:11:47.337 7166M]   -  OK  IPv4 interface eth0 (2,0) is 192.168.2.254
[2021-10-27 18:11:47.337 7166M]   - SKIP IPv4 interface lo: (1,0) != (2,0)
[2021-10-27 18:11:47.337 7166M]   -  OK  IPv6 interface eth0 (2,0) is fe80::40f:43ff:fe60:fa56 (LL)
[2021-10-27 18:11:47.337 7166M]   - SKIP IPv6 interface lo: (1,0) != (2,0)
[2021-10-27 18:11:47.337 7166M] Processing FTL hook from src/dnsmasq/forward.c:1573...
[2021-10-27 18:11:47.337 7166M]      Flags: F_FORWARD F_IPV4 F_QUERY 
[2021-10-27 18:11:47.337 7166M] Waiting for SHM lock in _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:586)
[2021-10-27 18:11:47.337 7166M] Obtained SHM lock for _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:586)
[2021-10-27 18:11:47.337 7166M] **** new UDP IPv4 query[A] query "trace.svc.ui.com" from eth0:192.168.2.1#57927 (ID 725, FTL 6828, src/dnsmasq/forward.c:1575)
[2021-10-27 18:11:47.337 7166M] getOverTimeID(1635354900): 145
[2021-10-27 18:11:47.337 7166M] Query 725: status unchanged: UNKNOWN (0) in src/dnsmasq_interface.c:695
[2021-10-27 18:11:47.337 7166M] Setting DNSSEC status to INSECURE in src/dnsmasq_interface.c:710
[2021-10-27 18:11:47.338 7166M] trace.svc.ui.com is known as gravity blocked
[2021-10-27 18:11:47.338 7166M] Query 725: status changed: UNKNOWN (0) -> GRAVITY (1) in src/dnsmasq_interface.c:2288
[2021-10-27 18:11:47.338 7166M] getOverTimeID(1635354900): 145
[2021-10-27 18:11:47.338 7166M] Removed lock in _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:804)
[2021-10-27 18:11:47.338 7166M] Preparing reply for "trace.svc.ui.com", EDE: N/A
[2021-10-27 18:11:47.338 7166M]      Flags: F_IPV4 
[2021-10-27 18:11:47.338 7166M]   Adding RR: "trace.svc.ui.com A 0.0.0.0"
[2021-10-27 18:11:47.338 7166M] Processing FTL hook from src/dnsmasq_interface.c:347...
[2021-10-27 18:11:47.338 7166M]      Flags: F_HOSTS F_IPV4 
[2021-10-27 18:11:47.338 7166M] Waiting for SHM lock in FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:1857)
[2021-10-27 18:11:47.338 7166M] Obtained SHM lock for FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:1857)
[2021-10-27 18:11:47.338 7166M] **** got cache reply: trace.svc.ui.com is 0.0.0.0 (ID 725, src/dnsmasq_interface.c:347)
[2021-10-27 18:11:47.338 7166M] Skipping detection of external blocking IP for ID 725 as origin is HOSTS
[2021-10-27 18:11:47.338 7166M] Set reply to IP (4) in src/dnsmasq_interface.c:2039
[2021-10-27 18:11:47.338 7166M] Setting DNSSEC status to INSECURE in src/dnsmasq_interface.c:2046
[2021-10-27 18:11:47.338 7166M] Removed lock in FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:2051)
[2021-10-27 18:11:47.338 7166M] Interfaces: Called from src/dnsmasq/forward.c:1545
[2021-10-27 18:11:47.338 7166M] Identifying interface (looking for 192.168.2.254):
[2021-10-27 18:11:47.338 7166M]   - IPv4 interface eth0 (2,0) is 192.168.2.254
[2021-10-27 18:11:47.338 7166M]     ^^^ MATCH ^^^
[2021-10-27 18:11:47.338 7166M] Analyzing interfaces:
[2021-10-27 18:11:47.338 7166M]   -  OK  IPv4 interface eth0 (2,0) is 192.168.2.254
[2021-10-27 18:11:47.338 7166M]   - SKIP IPv4 interface lo: (1,0) != (2,0)
[2021-10-27 18:11:47.338 7166M]   -  OK  IPv6 interface eth0 (2,0) is fe80::40f:43ff:fe60:fa56 (LL)
[2021-10-27 18:11:47.338 7166M]   - SKIP IPv6 interface lo: (1,0) != (2,0)
[2021-10-27 18:11:47.338 7166M] Processing FTL hook from src/dnsmasq/forward.c:1573...
[2021-10-27 18:11:47.338 7166M]      Flags: F_FORWARD F_IPV4 F_QUERY 
[2021-10-27 18:11:47.338 7166M] Waiting for SHM lock in _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:586)
[2021-10-27 18:11:47.338 7166M] Obtained SHM lock for _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:586)
[2021-10-27 18:11:47.338 7166M] **** new UDP IPv4 query[AAAA] query "trace.svc.ui.com" from eth0:192.168.2.1#53238 (ID 726, FTL 6829, src/dnsmasq/forward.c:1575)
[2021-10-27 18:11:47.338 7166M] getOverTimeID(1635354900): 145
[2021-10-27 18:11:47.338 7166M] Query 726: status unchanged: UNKNOWN (0) in src/dnsmasq_interface.c:695
[2021-10-27 18:11:47.338 7166M] Setting DNSSEC status to INSECURE in src/dnsmasq_interface.c:710
[2021-10-27 18:11:47.338 7166M] trace.svc.ui.com is known as gravity blocked
[2021-10-27 18:11:47.338 7166M] Query 726: status changed: UNKNOWN (0) -> GRAVITY (1) in src/dnsmasq_interface.c:2288
[2021-10-27 18:11:47.338 7166M] getOverTimeID(1635354900): 145
[2021-10-27 18:11:47.338 7166M] Removed lock in _FTL_new_query() (/__w/FTL/FTL/src/dnsmasq_interface.c:804)
[2021-10-27 18:11:47.338 7166M] Preparing reply for "trace.svc.ui.com", EDE: N/A
[2021-10-27 18:11:47.338 7166M]      Flags: F_IPV6 
[2021-10-27 18:11:47.338 7166M]   Adding RR: "trace.svc.ui.com AAAA ::"
[2021-10-27 18:11:47.338 7166M] Processing FTL hook from src/dnsmasq_interface.c:375...
[2021-10-27 18:11:47.338 7166M]      Flags: F_HOSTS F_IPV6 
[2021-10-27 18:11:47.338 7166M] Waiting for SHM lock in FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:1857)
[2021-10-27 18:11:47.338 7166M] Obtained SHM lock for FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:1857)
[2021-10-27 18:11:47.338 7166M] **** got cache reply: trace.svc.ui.com is :: (ID 726, src/dnsmasq_interface.c:375)
[2021-10-27 18:11:47.338 7166M] Skipping detection of external blocking IP for ID 726 as origin is HOSTS
[2021-10-27 18:11:47.338 7166M] Set reply to IP (4) in src/dnsmasq_interface.c:2039
[2021-10-27 18:11:47.338 7166M] Setting DNSSEC status to INSECURE in src/dnsmasq_interface.c:2046
[2021-10-27 18:11:47.338 7166M] Removed lock in FTL_reply() (/__w/FTL/FTL/src/dnsmasq_interface.c:2051)
```
2

From the Pi terminal, what is the complete output of the following:

dig reddit.com @127.0.0.1

grep reddit.com /var/log/pihole.log | tail -n20

Edit - also:

Please upload a debug log and post just the token URL that is generated after the log is uploaded by running the following command from the Pi-hole host terminal:

pihole -d

or do it through the Web interface:

Tools > Generate Debug Log

3 
root@pi-hole:~# dig reddit.com @127.0.0.1

; <<>> DiG 9.11.5-P4-5.1+deb10u5-Debian <<>> reddit.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 54424
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;reddit.com.                    IN      A

;; AUTHORITY SECTION:
reddit.com.             3600    IN      SOA     cleanbrowsing.rpz.noc.org. accesspolicy.rpz.noc.org. 1 7200 900 1209600 86400

;; Query time: 55 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Oct 27 20:01:16 WEST 2021
;; MSG SIZE  rcvd: 113

root@pi-hole:~# grep reddit.com /var/log/pihole.log | tail -n20
Oct 27 18:32:09 dnsmasq[7479]: query[A] www.reddit.com from 192.168.1.106
Oct 27 18:32:09 dnsmasq[7479]: cached www.reddit.com is NXDOMAIN
Oct 27 19:02:09 dnsmasq[7479]: query[A] www.reddit.com from 192.168.1.106
Oct 27 19:02:09 dnsmasq[7479]: cached www.reddit.com is NXDOMAIN
Oct 27 19:14:13 dnsmasq[7479]: query[A] www.reddit.com from 192.168.1.106
Oct 27 19:14:13 dnsmasq[7479]: cached www.reddit.com is NXDOMAIN
Oct 27 19:20:41 dnsmasq[7479]: query[A] www.reddit.com from 192.168.1.106
Oct 27 19:20:41 dnsmasq[7479]: forwarded www.reddit.com to 8.8.8.8
Oct 27 19:20:41 dnsmasq[7479]: reply www.reddit.com is NXDOMAIN
Oct 27 20:01:16 dnsmasq[7479]: query[A] reddit.com from 127.0.0.1
Oct 27 20:01:16 dnsmasq[7479]: forwarded reddit.com to 8.8.8.8
Oct 27 20:01:16 dnsmasq[7479]: forwarded reddit.com to 8.8.4.4
Oct 27 20:01:16 dnsmasq[7479]: forwarded reddit.com to 208.67.222.222
Oct 27 20:01:16 dnsmasq[7479]: forwarded reddit.com to 208.67.220.220
Oct 27 20:01:16 dnsmasq[7479]: forwarded reddit.com to 4.2.2.1
Oct 27 20:01:16 dnsmasq[7479]: forwarded reddit.com to 4.2.2.2
Oct 27 20:01:16 dnsmasq[7479]: forwarded reddit.com to 1.1.1.1
Oct 27 20:01:16 dnsmasq[7479]: forwarded reddit.com to 1.0.0.1
Oct 27 20:01:16 dnsmasq[7479]: forwarded reddit.com to 1.1.1.2
Oct 27 20:01:16 dnsmasq[7479]: reply reddit.com is NXDOMAIN
4

token is
send

5

What is the output of the following command from the Pi terminal:

pihole -q -exact reddit.com

7

root@pi-hole:~# pihole -q -exact reddit.com
[i] No exact results found for reddit.com within the block lists

8

From the Pi terminal, what is the output of:

nslookup reddit.com 8.8.8.8

9

root@pi-hole:~# pihole -q -exact reddit.com
[i] No exact results found for reddit.com within the block lists
root@pi-hole:~# ^C
root@pi-hole:~# nslookup reddit.com 8.8.8.8
Server: 8.8.8.8
Address: 8.8.8.8#53

** server can't find reddit.com: NXDOMAIN

10

If i change my dns from the pc to 8.8.8.8 i cant access, if i pass by the pi hole...that is the result

13

You are running clean browsing software? This appears to be catching your DNS queries, and they are not going to the designated upstream providers.

What you show:

; AUTHORITY SECTION:
reddit.com.             3600    IN      SOA     cleanbrowsing.rpz.noc.org. accesspolicy.rpz.noc.org. 1 7200 900 1209600 86400

What you should see:

;; AUTHORITY SECTION:
.			2638	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2021102701 1800 900 604800 86400
14

I'm not sure what are you asking when you say

You are running clean browsing software?

if i'm running on the shell of the pi hole machine how can it be passing throw CleanBrowsing.org?

The vm where the pi hole runs has nothing more then that, the pi-hole.

the bash you have send shell i run it?

15

result from the script

1
0
0

16

Your output shows this.

17

just ran the same command twice:

root@pi-hole:/tmp# dig reddit.com @127.0.0.1

; <<>> DiG 9.11.5-P4-5.1+deb10u5-Debian <<>> reddit.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61101
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;reddit.com.                    IN      A

;; ANSWER SECTION:
reddit.com.             300     IN      A       151.101.1.140
reddit.com.             300     IN      A       151.101.193.140
reddit.com.             300     IN      A       151.101.129.140
reddit.com.             300     IN      A       151.101.65.140

;; Query time: 123 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Oct 27 21:02:07 WEST 2021
;; MSG SIZE  rcvd: 103
18

however the browser still has the same behavior

PS: I've clean the entire browser history and data before running this command, but once more the problem is i'm running the commands on the pi-hole shell not on any pc or device connected to the network

19

a few minutes latter

root@pi-hole:/tmp# dig reddit.com @127.0.0.1

; <<>> DiG 9.11.5-P4-5.1+deb10u5-Debian <<>> reddit.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 269
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;reddit.com. IN A

;; AUTHORITY SECTION:
reddit.com. 3600 IN SOA cleanbrowsing.rpz.noc.org. accesspolicy.rpz.noc.org. 1 7200 900 1209600 86400

;; Query time: 53 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Wed Oct 27 21:15:31 WEST 2021
;; MSG SIZE rcvd: 113

20

im almost blocking cleanbrowsing.rpz.noc.org o whatever this is but i don't now where it's coming from

21

There is a clean browsing setting at work somewhere in that browser or client, or perhaps even on your router.

22

I still can't understand why pi hole update it's records if one client on the network has that safe browsing setting.

It can be anything anywhere on this 100 plus device network.

Anyway to block this update on the pi hole?

23

Provided it doesn't match any of your Pi-hole's blocking criteria, a DNS query received by your Pi-hole will be forwarded to one of your Pi-hole's configured upstreams.

If Pi-hole would block a domain, you'd see 0.0.0.0 or :: for reddit.com.
Since you don't, the reply you receive is provided by
a) one of Pi-hole's upstreams
b) a DNS resolver intercepting requests on a client

(a) seems more likely, as you have run your dig from your Pi-hole host machine.
In addition, your dig returning SOA cleanbrowsing.rpz.noc.org. clearly indicates that DNS is handled by CleanBrowsing.org, at least for that specific lookup.
You can reproduce this by forcing a lookup through one of CleanBrowsing's DNS servers, e.g.

dig reddit.com @185.228.168.168

I guess either your router is configured to use the services of CleanBrowsing.org to filter DNS requests, or your ISP is doing so.

Specifically, check whether 185.228.168.168 or 185.228.169.168 would show up as DNS server in your router's configuration.

You'd have to consult your router's documentation and support for further details, or contact your ISP, respectively.