# Deep CNAME Inspection False-Positive Evidence

## Reproduction (2026-06-03, Pi-hole v6.4.2 + v6.6.2 FTL)

### Test: domains caught by CNAME chain propagation

When `CNAMEdeepInspect = true`, Pi-hole follows CNAME chains and blocks the ENTIRE
chain if ANY intermediate domain is in a blocklist. The blocklist (StevenBlack
hosts) includes specific Google ad subdomains like `pagead.l.google.com` and
`ssl-google-analytics.l.google.com`, but deep CNAME inspection propagates the
block to the PARENT domains that many essential services depend on.

### Confirmed: parent domains in blocklist (via pihole -q)

```
gstatic.com       → IN BLOCKLIST (subdomains: various ad-related)
l.google.com      → IN BLOCKLIST (subdomains: pagead, ssl-google-analytics, etc.)
googlehosted.com  → IN BLOCKLIST
1e100.net         → IN BLOCKLIST
```

### Domains getting false-positive status 14 (cached-as-blocked)

| Domain | Status 14 count | What it breaks |
|---|---|---|
| dns.msftncsi.com | 514 | Windows internet connectivity check |
| ps5.np.playstation.net | 313 | PlayStation Network |
| api.weather.com | 303 | Weather apps/widgets |
| connectivitycheck.gstatic.com | 83 | Android TV connectivity check |
| google.com | 121 | Basic connectivity |
| ota.nvidia.com | 64 | Shield TV system updates |
| api.ring.com | 143 | Ring doorbell |
| graph.facebook.com | 80 | Facebook/Instagram |

### The connectivity kill chain

1. Android TV queries `connectivitycheck.gstatic.com`
2. Pi-hole follows CNAME → `some-host.l.google.com`
3. `l.google.com` matches blocklist (subdomain entries)
4. Deep CNAME inspection: entire chain → blocked
5. Pi-hole caches status 14 (blocked)
6. Android TV: "No internet" → disables network features
7. Device stops making DNS queries entirely (confirmed via FTL DB: Shield TV .24 went silent after status 14 on connectivitycheck.gstatic.com)

### Confirming the Shield TV case

Shield TV at 192.168.50.24, Ethernet-connected:
- Last DNS queries at 19:27 (connectivitycheck.gstatic.com = RETRIED, ota.nvidia.com = status 14)
- Ping: 100% packet loss (IP stack unresponsive)
- ARP: REACHABLE (Ethernet hardware alive)
- Android TV's strict connectivity check: one failed DNS → "no internet" → gives up