Tpc.googlesyndication.com and googleads.g.doubleclick.net getting through

Help
1

Expected Behaviour:

Pihole blocks tpc.googlesyndication.com and googleads.g.doubleclick.net getting through

Actual Behaviour:

tpc.googlesyndication.com and googleads.g.doubleclick.net getting through

Debug Token:

https://tricorder.pi-hole.net/jlze6994r8

I've installe pi-hole today and for some reason, tpc.googlesyndication.com and googleads.g.doubleclick.net are getting through. The site I test is https://www.demorgen.be/.

Something I noticed is that these ads are all loaded inside an amp-img.

2

A few thoughts:

  1. You are using block lists that are questionable.
https://dbl.oisd.nl/
https://dbl.oisd.nl/light/

The list maintainer selectively whitelists domains and does not publicize the domains they choose to whitelist. Domains that you would expect to be blocked are not always blocked. I would ditch these lists and select from more reputable lists here: https://wally3k.github.io

  1. Of the two questionable blocklists, only the second one is enabled. Let's check that list to see if it contains the two domains; and find it does.
pihole -q tpc.googlesyndication.com
 Match found in https://dbl.oisd.nl/light/:
   tpc.googlesyndication.com 
   tpc.googlesyndication.com.proxy.c9w.net

pihole -q googleads.g.doubleclick.net
Match found in **https://dbl.oisd.nl/light/** :
googleads.g.doubleclick.net
  1. The regex you have crafted are incorrect:

You have .*googlesyndication.* , which does not block tpc.googlesyndication.com

Add googlesyndication.com as a wildcard blacklist entry, and Pi-hole will convert that to the following regex which does block that domain.

(\.|^)googlesyndication\.com$

  1. If the browser you are using is able to load these domains, then the DNS queries for that browser are not going to Pi-hole. This can be caused by a few things:

  • The browser is using a DNS other than the DNS provided by the client OS (i.e. DNS over HTTPS).

  • The client is not using Pi-hole for DNS resolution.

From the client command prompt or terminal (and not via ssh into the Pi terminal), what are the outputs of the following:

nslookup pi.hole

nslookup tpc.googlesyndication.com 192.168.178.13

3
  1. I've removed the block list and moved to https://adaway.org/hosts.txt
  2. I've ran your test and this returned:
pihole -q tpc.googlesyndication.com
Match found in regex blacklist
  (\.|^)googlesyndication\.com$
Match found in https://adaway.org/hosts.txt:
  tpc.googlesyndication.com

pihole -q googleads.g.doubleclick.net
Match found in https://adaway.org/hosts.txt:
  googleads.g.doubleclick.net
  1. I've removed the regex as suggested and match is confirmed in 2.
  2. nslookup pi.hole returns this the following:
Server:  raspberrypi
Address:  2a02:578:857c:e00:6bee:313f:5c48:e6c6

Name:    pi.hole
Addresses:  2a02:578:857c:e00:6bee:313f:5c48:e6c6
          192.168.178.13

nslookup tpc.googlesyndication.com 192.168.178.13 gives this:

Server:  raspberrypi
Address:  192.168.178.13

Name:    tpc.googlesyndication.com
Addresses:  ::
          0.0.0.0
4

This confirms that Pi-hole is blocking that domain and the client is using Pi-hole for DNS.

Either the browser is using an alternate DNS, or the ads are coming from other domains.

5

It somehow got fixed by restarting the troubled pc. It was a company pc which was running under a VPN before. Restarting removed the VPN and now adds are gone. Not sure if it will return after enabling the VPN but now I probably know the cause at least.

6

It will. When a client device is on a VPN service, the DNS for that device moves to the DNS of the VPN service as well, to prevent DNS traffic outside the VPN tunnel.