An increasing number of devices ship with hard coded DNS servers - usually 8.8.8.8 and 8.8.4.4. You need more than PiHole in those situations as you also need t

An increasing number of devices ship with hard coded DNS servers - usually 8.8.8.8 and 8.8.4.4. You need more than PiHole in those situations as you also need to transparently redirect DNS to PiHole/AdGuard Home. But that’s not enough by itself. Things can still use DNS over HTTPS and DNS over TLS. Even Firefox will try this unless configured otherwise. You can add the canary domain for well behaved apps to say don’t use those protocols, but poorly/maliciously configured apps can still ignore that. So then you’re in an arms race with blocking publicly known DNS over HTTPS servers. You can do it, but it’s tiring. But hey, I’ve learned a lot more about iptables and how to manage them on my UDM Pro as a result.