ECS (Extended Client Subnet) defines a mechanism for recursive resolvers to send partial client IP address information to authoritative DNS name servers. Content Delivery Networks (CDNs) and latency-sensitive services use this to give geo-located responses when responding to name lookups coming through public DNS resolvers. Note that ECS may result in reduced privacy.
Use this list to add your own custom DNS servers. Servers selected in the table above are configured separately and are not shown here. The expected format is one server per line in form of IP#port, where the port is optional. If given, it has to be separated by a hash # from the address (e.g. 127.0.0.1#5335 for a local unbound instance running on port 5335). The port defaults to 53 if omitted.
The DNS domains for your Pi-hole. This DNS domain is purely local. FTL may answer queries from its local cache and configuration but *never* forwards any requests upstream *unless* you have configured a dns.revServer exactly for this domain. If no domain is specified and you are using Pi-hole's DHCP server, then any hostnames with a domain part (i.e., with a period) will be disallowed. If a domain is specified, then hostnames with a domain parts matching the domain here are allowed. In addition, when a suffix is set then hostnames without a domain part have the suffix added as an optional domain part.
If set, the domain is added to simple names (without a period) in /etc/hosts in the same way as for DHCP-derived names.
Block clients making more than queries within seconds.
When a client makes too many queries in too short time, it
gets rate-limited. Rate-limited queries are answered with a
REFUSED reply and not further processed by FTL
and prevent Pi-holes getting overwhelmed by rogue clients.
It is important to note that rate-limiting is happening on a
per-client basis. Other clients can continue to use FTL while
rate-limited clients are short-circuited at the same time.
Rate-limiting may be disabled altogether by setting both values to zero.
Allows only queries from devices that are at most one hop away (local devices)
These options are dangerous on devices directly connected to the Internet such as cloud instances and are only safe if your Pi-hole is properly firewalled. In a typical at-home setup where your Pi-hole is located within your local network (and you have not forwarded port 53 in your router!) they are safe to use.
See our documentation for further technical details.
Tells Pi-hole to never forward queries for plain
names, without dots or domain parts, to upstream nameservers. If
the name is not known from /etc/hosts or DHCP then a "not found"
answer is returned.
If Conditional Forwarding is enabled, unticking this box may cause a partial
DNS loop under certain circumstances (e.g. if a client would send TLD DNSSEC queries).
All reverse lookups for private IP ranges (i.e., 192.168.0.x/24, etc.)
which are not found in /etc/hosts or the DHCP leases are answered
with "no such domain" rather than being forwarded upstream. The set
of prefixes affected is the list given in RFC6303.
Important:
Enabling these two options may increase your privacy,
but may also prevent you from being able to access local hostnames if the Pi-hole is not used as DHCP server.
Make sure you have set up conditional forwarding in this case.
Validate DNS replies and cache DNSSEC data. When forwarding DNS queries, Pi-hole requests the DNSSEC records needed to validate the replies. If a domain fails validation or the upstream does not support DNSSEC, this setting can cause issues resolving domains. Use an upstream DNS server which supports DNSSEC when activating DNSSEC. Note that the size of your log might increase significantly when enabling DNSSEC. A DNSSEC resolver test can be found here.
If not configured as your DHCP server, Pi-hole typically won't be able to determine the names of devices on your local network. As a result, tables such as Top Clients will only show IP addresses.
One solution for this is to configure Pi-hole to forward these requests to your DHCP server (most likely your router), but only for devices on your home network. To configure this we will need to know the IP address of your DHCP server and which addresses belong to your local network. Exemplary input is given below as placeholder in the text boxes (if empty).
Enabling Conditional Forwarding will also forward all hostnames (i.e., non-FQDNs) to the router when "Never forward non-FQDNs" is not enabled.
The following list contains all reverse servers you want to add.
| Enabled | Network Range 1 | Server IP 2 | Domain 3 | |
|---|---|---|---|---|
|
||||