# Upstream DNS Servers

IPv4 | IPv6 | Name
--- | --- | ---

ECS (Extended Client Subnet) defines a mechanism for recursive resolvers to send partial client IP address information to authoritative DNS name servers. Content Delivery Networks (CDNs) and latency-sensitive services use this to give geo-located responses when responding to name lookups coming through public DNS resolvers. Note that ECS may result in reduced privacy.

### Custom DNS servers

The following list contains all DNS servers selected above. Furthermore, you can add your own custom DNS servers here. The expected format is one server per line in form of `IP#port`, where the `port` is optional. If given, it has to be separated by a hash `#` from the address (e.g. `127.0.0.1#5335` for a local `unbound` instance running on port `5335`). The port defaults to 53 if omitted.

### DNS domain settings

Pi-hole domain name
Domain

The DNS domains for your Pi-hole. This DNS domain is purely local. FTL may answer queries from its local cache and configuration but *never* forwards any requests upstream *unless* you have configured a dns.revServer exactly for this domain. If no domain is specified and you are using Pi-hole's DHCP server, then any hostnames with a domain part (i.e., with a period) will be disallowed. If a domain is specified, then hostnames with a domain parts matching the domain here are allowed. In addition, when a suffix is set then hostnames without a domain part have the suffix added as an optional domain part.

Expand hostnames

If set, the domain is added to simple names (without a period) in /etc/hosts in the same way as for DHCP-derived names.

### Rate-limiting

Block clients making more than queries within seconds.

When a client makes too many queries in too short time, it gets rate-limited. Rate-limited queries are answered with a `REFUSED` reply and not further processed by FTL and prevent Pi-holes getting overwhelmed by rogue clients. It is important to note that rate-limiting is happening on a per-client basis. Other clients can continue to use FTL while rate-limited clients are short-circuited at the same time.

Rate-limiting may be disabled altogether by setting both values to zero.

# Interface settings

#### Recommended setting

Allow only local requests

Allows only queries from devices that are at most one hop away (local devices)

#### Potentially dangerous options

Make sure your Pi-hole is properly firewalled!
Respond only on interface ``
Bind only to interface ``
Permit all origins

These options are dangerous on devices directly connected to the Internet such as cloud instances and are only safe if your Pi-hole is properly firewalled. In a typical at-home setup where your Pi-hole is located within your local network (and you have not forwarded port 53 in your router!) they are safe to use.

See our documentation for further technical details.

### Advanced DNS settings

Never forward non-FQDN queries

Tells Pi-hole to never forward queries for plain names, without dots or domain parts, to upstream nameservers. If the name is not known from `/etc/hosts` or DHCP then a "not found" answer is returned.
If Conditional Forwarding is enabled, unticking this box may cause a partial DNS loop under certain circumstances (e.g. if a client would send TLD DNSSEC queries).

Never forward reverse lookups for private IP ranges

All reverse lookups for private IP ranges (i.e., `192.168.0.x/24`, etc.) which are not found in `/etc/hosts` or the DHCP leases are answered with "no such domain" rather than being forwarded upstream. The set of prefixes affected is the list given in RFC6303.

Important:
Enabling these two options may increase your privacy, but may also prevent you from being able to access local hostnames if the Pi-hole is not used as DHCP server. Make sure you have set up conditional forwarding in this case.

Use DNSSEC

Validate DNS replies and cache DNSSEC data. When forwarding DNS queries, Pi-hole requests the DNSSEC records needed to validate the replies. If a domain fails validation or the upstream does not support DNSSEC, this setting can cause issues resolving domains. Use an upstream DNS server which supports DNSSEC when activating DNSSEC. Note that the size of your log might increase significantly when enabling DNSSEC. A DNSSEC resolver test can be found here.

### Conditional forwarding

If not configured as your DHCP server, Pi-hole typically won't be able to determine the names of devices on your local network. As a result, tables such as Top Clients will only show IP addresses.

One solution for this is to configure Pi-hole to forward these requests to your DHCP server (most likely your router), but only for devices on your home network. To configure this we will need to know the IP address of your DHCP server and which addresses belong to your local network. Exemplary input is given below as placeholder in the text boxes (if empty).

If your local network spans 192.168.0.1 - 192.168.0.255, then you will have to input `192.168.0.0/24`. If your local network is 192.168.47.1 - 192.168.47.255, it will be `192.168.47.0/24` and similar. If your network is larger, the CIDR has to be different, for instance a range of 10.8.0.1 - 10.8.255.255 results in `10.8.0.0/16`, whereas an even wider network of 10.0.0.1 - 10.255.255.255 results in `10.0.0.0/8`. Setting up IPv6 ranges is exactly similar to setting up IPv4 here and fully supported. Feel free to reach out to us on our Discourse forum in case you need any assistance setting up local host name resolution for your particular system.

You can also specify a local domain name (like `fritz.box`) to ensure queries to devices ending in your local domain name will not leave your network, however, this is optional. The local domain name must match the domain name specified in your DHCP server for this to work. You can likely find it within the DHCP settings.

Enabling Conditional Forwarding will also forward all hostnames (i.e., non-FQDNs) to the router when "Never forward non-FQDNs" is not enabled.

The following list contains all reverse servers you want to add. The expected format is one server per line in form of `<enabled>,<ip-address>[/<prefix-len>],<server>[#<port>][,<domain>]`. A valid config line could look like `true,192.168.0.0/24,192.168.0.1,fritz.box`