ray
2.2 KiB
2.2 KiB
Deep CNAME Inspection False-Positive Evidence
Reproduction (2026-06-03, Pi-hole v6.4.2 + v6.6.2 FTL)
Test: domains caught by CNAME chain propagation
When CNAMEdeepInspect = true, Pi-hole follows CNAME chains and blocks the ENTIRE
chain if ANY intermediate domain is in a blocklist. The blocklist (StevenBlack
hosts) includes specific Google ad subdomains like pagead.l.google.com and
ssl-google-analytics.l.google.com, but deep CNAME inspection propagates the
block to the PARENT domains that many essential services depend on.
Confirmed: parent domains in blocklist (via pihole -q)
gstatic.com → IN BLOCKLIST (subdomains: various ad-related)
l.google.com → IN BLOCKLIST (subdomains: pagead, ssl-google-analytics, etc.)
googlehosted.com → IN BLOCKLIST
1e100.net → IN BLOCKLIST
Domains getting false-positive status 14 (cached-as-blocked)
| Domain | Status 14 count | What it breaks |
|---|---|---|
| dns.msftncsi.com | 514 | Windows internet connectivity check |
| ps5.np.playstation.net | 313 | PlayStation Network |
| api.weather.com | 303 | Weather apps/widgets |
| connectivitycheck.gstatic.com | 83 | Android TV connectivity check |
| google.com | 121 | Basic connectivity |
| ota.nvidia.com | 64 | Shield TV system updates |
| api.ring.com | 143 | Ring doorbell |
| graph.facebook.com | 80 | Facebook/Instagram |
The connectivity kill chain
- Android TV queries
connectivitycheck.gstatic.com - Pi-hole follows CNAME →
some-host.l.google.com l.google.commatches blocklist (subdomain entries)- Deep CNAME inspection: entire chain → blocked
- Pi-hole caches status 14 (blocked)
- Android TV: "No internet" → disables network features
- Device stops making DNS queries entirely (confirmed via FTL DB: Shield TV .24 went silent after status 14 on connectivitycheck.gstatic.com)
Confirming the Shield TV case
Shield TV at 192.168.50.24, Ethernet-connected:
- Last DNS queries at 19:27 (connectivitycheck.gstatic.com = RETRIED, ota.nvidia.com = status 14)
- Ping: 100% packet loss (IP stack unresponsive)
- ARP: REACHABLE (Ethernet hardware alive)
- Android TV's strict connectivity check: one failed DNS → "no internet" → gives up