Some network IPs are no longer showing up in system logs, query logs, BUT still resolves?

Project23D · November 20, 2025, 6:50pm

Until x time ago, all queries were showing up in the device list, query log, etc.

There are four internal networks that use pi-hole.

We’ll call the networks: office, server, vpn, and voip.

All networks, except office, show up in the query logs, on the dashboard, etc.

THERE HAVE BEEN NO CHANGES TO ANYTHING RELATED.
→ DNS, DHCP, routing, etc.
→ I’m the only one with access.

Wireshark packet capture shows my machine on the office network is talking to and is being responded appropriately by pi-hole.
But my office network IP and queries are not showing up in pi-hole.. Nor are any other host on the office network.

Expected Behaviour:

all DNS queries, from all networks are resolved and show up in logs

Debian 12
proxmox 8.1.x
no docker
server RFC 1918 network IP, no NAT

Actual Behaviour:

office network IPs are not being reported or logged.

Debug Token:

cannot publicize

robgill · November 20, 2025, 8:23pm

Probably not going to get too far without that.

Other steps to try:

Check your settings for dns servers on the “office” machines to determine how their networks have actually been configured.

Failing that, try wireshark on one or more machines on the “office” network and see where the queries are actually going.

Project23D · November 21, 2025, 2:10pm

queries are actually going to pihole.

For the sake of re-iteration, both DNS servers on my box that is on the office network are set to the same IP of pihole.
_dns.resolver.arpa has been set so browsers are not using their own DoH

as far as the debug token, maybe okay for a home network. Not for a website host.

deHakkelaar · November 21, 2025, 3:39pm

Notice below bit when running the debugger:

NOTE: All log files auto-delete after 48 hours and ONLY the Pi-hole developers can access your data via the given token. We have taken these extra steps to secure your data and will work to further reduce any personal information gathered.

DanSchaper · November 21, 2025, 5:03pm

Our ability to help you depends on your ability to trust us and to provide us with access to the information we need. If you do not want to provide us with the information then your help will be limited.

Project23D · November 21, 2025, 8:14pm

Howdy-
I am jealous of our network security and our settings are confidential.

If there was a way to obfuscate certain things, then I would.

DanSchaper · November 21, 2025, 8:32pm

Then you will need to wait for the community to help you.

nprampage · November 21, 2025, 8:59pm

So you’re trusting this code to run on your box, but you’re not trusting the people who wrote that code to debug your setup? If they were trying to do something untoward, they’d just embed it in the application code and not wait on you to send a debug log.

Plus the log that is generated is fully viewable by you; you’ll see exactly what these (very small number of) people are seeing.

rdwebdesign · November 21, 2025, 11:01pm

You can check what information is on the log in /var/log/pihole/pihole_debug.log.

If you think it is fine to upload your log, then generate a new one and upload it when asked. Only team members (less than 10 people) will have access to it and probably just one or two will actually open it.

If after reading the log you still think there is information you don't want to share, then you can wait for the community to help you.

Project23D · November 24, 2025, 2:03pm

Gents-

Thanks for the quick replies.
I probably missed the part where debug logs are not made public.

I’ll submit when requested.

DanSchaper · November 25, 2025, 2:45am

Please post the token URL. The logs live for 48 hours before autodelete and I can guaranty that someone from the support team will help you before that window closes.

Project23D · November 25, 2025, 1:20pm

https://tricorder.pi-hole.net/gvwkpTLD/

DanSchaper · November 25, 2025, 3:35pm

Thanks, which subnet are the missing hosts on?

And you've done a live tail of the query log (via CLI and not via the web interface query log) to see if there's any record of the query activity?

Are you sure that the Office subnet is truly using Pi-hole and not another DNS server? Do any of the missing clients show as green in the Network page on the web interface? Can you dig pi.hole from the Office clients and get a proper response and not an NXDOMAIN?

Project23D · November 25, 2025, 5:08pm

10.99.x.x/24

yes, done a tail -f while at the same time wireshark is running.

DHCP is set to provide only pihole for DNS.

The missing office network clients do not show up on the client list, or pihole.log, same as my box on the office network.

When setup, and until a couple weeks ago, as that is when I last looked at it until a few days ago, there were >100 hosts. Now there is 50-ish

just did:

DanSchaper · November 25, 2025, 5:26pm

That tells me that the office network is not using Pi-hole. That would explain why none of those clients are showing up in the Pi-hole logs yet the are still resolving.

Is the Address: of the DNS server the same as the Pi-hole IP address? Do you have any firewalls with rules set to NAT the DNS traffic from the office network to the Pi-hole?

Does a nslookup pi.hole <pi-hole_IP_address> show a proper IP response?

PS C:\Users\Dan> nslookup pi.hole. 192.168.1.5

Edit: If you are using nslookup on Windows then make sure the query is for pi.hole. with the trailing anchor dot, otherwise Windows will tag on the local search domain to the query.

Project23D · November 25, 2025, 7:28pm

Odd.
it won’t resolve pi.hole., but will the domain of this discourse:

More interestingly, I seem to recall there were some device updates in the last week in which there were some oddities.

I”m looking at iptraf and see my office network IP, and those of the other networks, but none other office network IPs show up.

My box in the office network is static IP, and it too does not show up in the pi-hole webUI client list, or Query log…. but it does on iptraf on the pi-hole box.

Kind of at a loss at to what changed, as stated before, I’m the only one with access, and changes to pi-hole are Teleported after successful implementation. Major changes are proxmox snapshot prior to change.. and there has not been any.

deHakkelaar · November 30, 2025, 1:53am

Project23D · December 1, 2025, 8:19pm

Good idea, but no dice.

the DHCP server is serving only one IP address for DNS and it is our pihole.
I just tried my Android, same result.

from my computer on the office network, I just tried nslookup on a host that is only in the local DNS entries of pihole.
There IP does not show up in the query list.
I do not have any type of AV/AM on this machine, all DNS is set to pihole.

The image below:
nslookup somedevice.internalnetwork

server is UnKnown
address: that of pi-hole

name and address info is being provided by pi-hole.

deHakkelaar · December 2, 2025, 5:32am

And below one?

nslookup -class=chaos -type=txt version.ftl <DNS_SERVER_IP>

If you dont get below or similar answer, something else not Pi-hole is answering:

C:\>nslookup -class=chaos -type=txt version.ftl 10.0.0.2
Server:  ph6a.home.dehakkelaar.nl
Address:  10.0.0.2

version.ftl     text =

        "v6.2.3"

Ps. you dont have to redact IPv4 addresses from the private range.
Everyone is using those exact same ranges.
But you should redact all IPv6 addresses that could localize you and sometimes exposes the MAC address.

Project23D · December 2, 2025, 3:36pm

I redact IP address as we do not use the common RFC1918 default ranges.

so, this morning, pihole quit repsonding slowly, then just died.
there have been ZERO changes to the network, firewalls routes.

I got complaints this morning about everything being slow.
went to a few of their machine, could ping the pihole fine <1ms) but failed to resolve.

So, I updated it. Or attempted to. That failed.
Now it’s broke.
What the hell windows infected shit is going on here.
https://tricorder.pi-hole.net/8kP6yL7d/