ray
52 lines
2.2 KiB
Markdown
52 lines
2.2 KiB
Markdown
# Deep CNAME Inspection False-Positive Evidence
|
|
|
|
## Reproduction (2026-06-03, Pi-hole v6.4.2 + v6.6.2 FTL)
|
|
|
|
### Test: domains caught by CNAME chain propagation
|
|
|
|
When `CNAMEdeepInspect = true`, Pi-hole follows CNAME chains and blocks the ENTIRE
|
|
chain if ANY intermediate domain is in a blocklist. The blocklist (StevenBlack
|
|
hosts) includes specific Google ad subdomains like `pagead.l.google.com` and
|
|
`ssl-google-analytics.l.google.com`, but deep CNAME inspection propagates the
|
|
block to the PARENT domains that many essential services depend on.
|
|
|
|
### Confirmed: parent domains in blocklist (via pihole -q)
|
|
|
|
```
|
|
gstatic.com → IN BLOCKLIST (subdomains: various ad-related)
|
|
l.google.com → IN BLOCKLIST (subdomains: pagead, ssl-google-analytics, etc.)
|
|
googlehosted.com → IN BLOCKLIST
|
|
1e100.net → IN BLOCKLIST
|
|
```
|
|
|
|
### Domains getting false-positive status 14 (cached-as-blocked)
|
|
|
|
| Domain | Status 14 count | What it breaks |
|
|
|---|---|---|
|
|
| dns.msftncsi.com | 514 | Windows internet connectivity check |
|
|
| ps5.np.playstation.net | 313 | PlayStation Network |
|
|
| api.weather.com | 303 | Weather apps/widgets |
|
|
| connectivitycheck.gstatic.com | 83 | Android TV connectivity check |
|
|
| google.com | 121 | Basic connectivity |
|
|
| ota.nvidia.com | 64 | Shield TV system updates |
|
|
| api.ring.com | 143 | Ring doorbell |
|
|
| graph.facebook.com | 80 | Facebook/Instagram |
|
|
|
|
### The connectivity kill chain
|
|
|
|
1. Android TV queries `connectivitycheck.gstatic.com`
|
|
2. Pi-hole follows CNAME → `some-host.l.google.com`
|
|
3. `l.google.com` matches blocklist (subdomain entries)
|
|
4. Deep CNAME inspection: entire chain → blocked
|
|
5. Pi-hole caches status 14 (blocked)
|
|
6. Android TV: "No internet" → disables network features
|
|
7. Device stops making DNS queries entirely (confirmed via FTL DB: Shield TV .24 went silent after status 14 on connectivitycheck.gstatic.com)
|
|
|
|
### Confirming the Shield TV case
|
|
|
|
Shield TV at 192.168.50.24, Ethernet-connected:
|
|
- Last DNS queries at 19:27 (connectivitycheck.gstatic.com = RETRIED, ota.nvidia.com = status 14)
|
|
- Ping: 100% packet loss (IP stack unresponsive)
|
|
- ARP: REACHABLE (Ethernet hardware alive)
|
|
- Android TV's strict connectivity check: one failed DNS → "no internet" → gives up
|