Why are ads breaking through, despite the serving domain being in two of my adlists?

OK, got that. But when I scroll back in the code to find what (I think) the server is, it seems to be pagead2.googlesyndication.com, which is also in mutliple adlists?

And dig reports:

; <<>> DiG 9.10.6 <<>> pagead2.googlesyndication.com

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8391

;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags:; udp: 1232

;; QUESTION SECTION:

;pagead2.googlesyndication.com. IN A

;; ANSWER SECTION:

pagead2.googlesyndication.com. 2 IN A 0.0.0.0

;; Query time: 36 msec

;; SERVER: 10.0.0.24#53(10.0.0.24)

;; WHEN: Mon Jan 15 13:13:26 PST 2024

;; MSG SIZE rcvd: 74

Perplexing!

So is this being blocked when using dig in a terminal but ads show up when using a browser? If so it sounds like a networking setting in the browser like DNS over HTTPS.

That's it! I'd enabled "Hide Ip Address" in Safari settngs (their iCloud Private Relay service), and had not thought through the implications. Correct, command line shows it's blocked, in Safari it is not. I didn't understand when 'hostmaster' brought this up earlier, so thanks to you both for the clarification.

THANK YOU FOR YOUR HELP.