NXDOMAIN And Null Blocking With FTLDNS
Pi-hole has traditionally returned a blank HTML page in place of advertisements. An alternative method is to return
NXDOMAIN—no such domain. This is a behaviour you asked us to implement and we have listened.
To use it, you’ll need to be running the FTLDNS beta (
pihole -up if you’re already on it):
echo "FTLDNS" | sudo tee /etc/pihole/ftlbranch pihole checkout core FTLDNS pihole checkout web FTLDNS
You can also checkout the
development branches, but if you want the most up-to-date code, use the
Once you’ve checked out on the new branches, you need to add this to
/etc/pihole/pihole-FTL.conf(note you may need to create this file if it does not exist)
depending on which method you prefer and then restart FTLDNS (
pihole-FTL) to apply the change
sudo service pihole-FTL restart
What Is NXDOMAIN?
This is a mechanism built into DNS that can be returned as an answer when the domain doesn’t exist. You can see this response by using
nslookup on a domain that is not likely to be registered:
me@pihole:~$ nslookup skfmndfosfmmpofpwmf.com Server: 22.214.171.124 Address: 126.96.36.199#53 ** server can't find skfmndfosfmmpofpwmf.com: NXDOMAIN
There are benefits and drawbacks to both methods, but
NXDOMAIN response has been an open feature request for some time. This functionality is now available in FTLDNS.
Benefits And Drawbacks Of Serving HTML Or Using A 404 (The current method)
- The block page can be used and is fully functional
- Additional software to run the Web server is needed
- Performance may be slightly impacted
- Firewall rules are often needed to prevent slow loading pages (But even then you can still run into issues with certain routers)
Benefits And Drawbacks Of NXDOMAIN
- Improved speed and performance
- No Web server needed
- No connections made to Pi-hole for blocked domains (except for the DNS request itself)
- No firewall rules needed
- Block page will not work
- You may see a browser error for blocked domains
- If you visit a blocked domain directly, your browser may say the domain doesn’t exist, which may be confusing
- Some connections will still try to connect to the non-existant domain for a few tries before it times out
What About Null Blocking?
Another method is null blocking, which responds with 0.0.0.0 or ::1. This special IP address is unspecified.
Benefits And Drawbacks
These are similar to that of
NXDOMAIN but this is more experimental so your mileage may vary,
Thanks to you, we can keep working on Pi-hole and implementing features you want. We’re currently running a fundraiser so please consider donating to our project!
[…] By default, Pi-Hole will return 0.0.0.0 for blocked domains. You can change this behaviour as documented on the official website. […]
Comments are closed.