Pi-hole DNS Protection

Project Overview

Standard DNS sends queries in plain text, exposing browsing habits and opening the door to DNS hijacking and surveillance. Pi-hole silently drops queries for known malicious and unwanted domains at the DNS layer, protecting every device on the network without installing anything on individual machines. Cloudflare's DoH proxy (cloudflared) wraps all upstream resolution in TLS, making DNS traffic indistinguishable from regular HTTPS.

How DNS-over-HTTPS Works Here

If Pi-hole matches the domain against a blocklist, the query is sinkholed immediately and never reaches cloudflared — saving bandwidth and blocking the threat before any connection is made.

Key Features

• Network-wide domain blocking — no per-device configuration needed
• DNS-over-HTTPS via cloudflared, encrypting all upstream queries over port 443
• Custom and community blocklists targeting malware, phishing, and tracking domains
• Real-time query logging and dashboard with per-client breakdown
• Local DNS caching to reduce latency and external query volume
• DNSSEC validation to block spoofed or tampered DNS responses
• Allowlist/denylist overrides for fine-grained control
• Works alongside existing firewall rules and Fail2ban

Suspicious Domain Categories Blocked

Pi-hole is configured to block entire categories of threat infrastructure, not just individual IPs.

Configuration Highlights

Key settings across cloudflared and Pi-hole:

Skills Demonstrated