Pi-hole with DoH — reliable DNS for home networks
A Pi-hole setup that handles DNS-over-HTTPS (DoH) and survives ISP changes. Useful for ad blocking, privacy, and network-wide DNS control.
Pi-hole installation
# on Raspberry Pi OS (Lite)
curl -sSL https://install.pi-hole.net | bash
sudo usermod -aG pihole $USER
DNS-over-HTTPS with cloudflared
Pi-hole supports DoH upstreams via cloudflared. This encrypts DNS queries and bypasses ISP DNS hijacking:
sudo mkdir -p /etc/cloudflared && cd /etc/cloudflared
sudo tee config.yml >/dev/null <<'YML'
no-autoupdate: true
proxy-dns: true
proxy-dns-port: 5053
proxy-dns-upstream:
- https://cloudflare-dns.com/dns-query
- https://dns.google/dns-query
YML
sudo systemctl enable --now cloudflared
Then in Pi-hole web UI: Settings → DNS → Custom 1 (IPv4) = 127.0.0.1#5053
Router configuration
Set your router's LAN DNS to the Pi's IP (both IPv4 and IPv6 if supported). Most devices will honor this, but some Android phones prefer public IPv6 resolvers — keep IPv4 DNS as fallback.
Remote access with Tailscale
Instead of port forwarding, use Tailscale for secure remote access:
- Install Tailscale on Pi and your devices
- Access Pi-hole admin UI via Tailscale IP
- Use Tailscale Funnel for temporary public access if needed
Why Tailscale: No open ports, automatic encryption, works behind NAT. Much safer than exposing services directly.
Monitoring and maintenance
- Check query logs regularly: Pi-hole web UI → Query Log
- Update blocklists: Settings → Adlists → Update Gravity
- Monitor Pi resource usage:
htoporsystemctl status pihole-FTL
Gotcha: Some IoT devices hardcode DNS (like Google Nest). You'll need router-level DNS redirection or DHCP reservations to force them to use Pi-hole.
TL;DR
Pi-hole + cloudflared DoH + Tailscale = ad-free, private DNS with remote access. Works reliably even when ISP changes DNS settings.