The dashboard proves blocking works — except on one phone, where ads sail through untouched. A network-wide system with one rebel device almost always means that device is not asking Pi-hole at all. This guide hunts down where its questions are really going.
Pi-hole can only filter questions it receives. If one device still shows ads while the rest of the house is clean, that device's DNS requests are going somewhere else — a setting on the device itself is overriding the network's instructions. There is a short list of usual suspects, and they differ by device type. Check them in this order, and confirm each fix in the Pi-hole query log, where the device's questions should start appearing the moment the override is removed.
Before touching any settings, get evidence. Filter the dashboard's query log by that device and use it for a minute. Two outcomes: no entries at all — the device never asks Pi-hole, and the rest of this guide applies; or entries appear but nothing is blocked — a different problem (the domains it visits are first-party, covered in the limits guide). Most one-device mysteries are the first kind.
At some point — a past troubleshooting session, a 'speed up the internet' tip — this device may have been given a manual DNS like 8.8.8.8 in its Wi-Fi or network settings. Manual settings beat DHCP instructions every time. Open the device's network settings for your home network and set DNS back to automatic (or to the Pi-hole address deliberately). Forget and rejoin the network if the setting will not clear.
Android phones have a Private DNS feature that sends lookups over an encrypted connection to a provider of its own, entirely past Pi-hole. If it is set to a hostname (your own, an ad-blocking provider's, or one an app configured), Pi-hole sees nothing. Set Private DNS to Off or Automatic for your home network expectations — automatic uses the network's DNS over the standard route in most cases. This single setting explains a large share of 'works on my laptop, not on my phone' reports.
Modern browsers can resolve names themselves using DNS over HTTPS, ignoring the system and the network entirely. If ads appear in one browser but the device's apps are filtered, check the browser's privacy settings for 'secure DNS' or 'use secure DNS' and set it to use the system/network resolver (or disable it). The same applies to some VPN and 'accelerator' apps — while they run, they carry all traffic, DNS included, through their own tunnel.
If your router offers IPv6, devices may be receiving DNS instructions over IPv6 from the router or provider, in parallel with your IPv4 Pi-hole setup — and using them preferentially. Honest options: configure the Pi-hole address in the router's IPv6 DNS settings too (and give the Pi-hole machine a stable IPv6 address), or, if you do not use IPv6 deliberately, disable IPv6 DNS advertisement/LAN IPv6 in the router. Half-configured IPv6 is a classic reason blocking seems to work 'only sometimes'.
Device theek karne ke baad pura network ek baar video ke setup se mila kar confirm kar lo.
▶️ Watch Full VideoThe phone is almost certainly not asking Pi-hole. The common causes are a manual DNS saved on the phone, Android's Private DNS feature sending lookups to its own provider, or the phone using IPv6 DNS from the router. The query log test on this page tells you which hunt to start.
Private DNS encrypts DNS lookups and sends them to a provider you choose in Android settings. It is a legitimate privacy feature, but while it points at an outside provider, Pi-hole receives nothing from that phone and cannot filter it. Set it to Off or Automatic at home if you want Pi-hole to do the filtering.
That browser is probably resolving names itself via DNS over HTTPS, bypassing both the device settings and Pi-hole. Change the browser's secure DNS setting to use the system or network resolver, and its queries will flow through Pi-hole like everything else.