Top permitted domain "none" and "none.fritz.box"

[herrwusel]

I have as top domains the following:

Where do these come from? Is it because I'm using unbound?

[DL6ER]

@herrwusel

Where do these come from?

Click on them to see the Query Log showing you who requested these domains.

[herrwusel]

Forgot to mention: they all come from the local host.

Is there a tool to inspect local requests?

[jfb]

All DNS requests and replies are logged in /var/log/pihole.log, which will show a bit more detail than the query log.

You can use Wireshark or tcpdump on the Pi to see all the packets from localhost.

[herrwusel]

Feb 16 00:00:38 dnsmasq[31718]: query[A] None from 127.0.0.1
Feb 16 00:00:38 dnsmasq[31718]: config None is NODATA-IPv4
Feb 16 00:00:38 dnsmasq[31718]: query[AAAA] None from 127.0.0.1
Feb 16 00:00:38 dnsmasq[31718]: config None is NODATA-IPv6
Feb 16 00:01:09 dnsmasq[31718]: query[A] None.fritz.box from 127.0.0.1
Feb 16 00:01:09 dnsmasq[31718]: forwarded None.fritz.box to 127.0.0.1
Feb 16 00:01:09 dnsmasq[31718]: query[AAAA] None.fritz.box from 127.0.0.1
Feb 16 00:01:09 dnsmasq[31718]: forwarded None.fritz.box to 127.0.0.1
Feb 16 00:01:09 dnsmasq[31718]: reply None.fritz.box is NXDOMAIN
Feb 16 00:01:09 dnsmasq[31718]: reply None.fritz.box is NXDOMAIN

I'll have a look with tcpdump tomorrow. Thanks so far!