mave@doof:~$

~/notes / launch-day-dns

#postmortem · #dns #reverse-proxy · 2026-10-15

Postmortem: the site worked everywhere but my house

On launch day the site loaded everywhere except my home network, where it showed the reverse proxy's default page. A forgotten wildcard DNS rule in Pi-hole was still claiming the root domain.

$ cat summary

On launch day, doof.quest loaded fine on mobile data but showed my reverse proxy's default page at home. A wildcard rule in Pi-hole answered the root domain, and every subdomain, with the proxy's address. I replaced the wildcard with one exact record per service.

$ cat impact

  • Only devices on my home network were affected. Everyone else got the real site.
  • Internal services and SSH kept working the whole time.

$ cat investigation

  • Pi-hole's Local DNS records page had only two entries, neither of them the root.
  • No Local CNAME records. Nothing in /etc/hosts. The router hands out Pi-hole as the only DNS server.
  • dig doof.quest through Pi-hole returned the proxy's private IP, while dig @1.1.1.1 returned Cloudflare. So Pi-hole was answering from somewhere the UI didn't show.
  • Grepping Pi-hole's config for the domain found it: two raw dnsmasq lines in misc.dnsmasq_lines.

$ cat root-cause

Months earlier I'd set up split DNS with a single rule:

address=/doof.quest/<proxy>
server=/<ssh-host>.doof.quest/1.1.1.1

dnsmasq's address= is a suffix match. It covers doof.quest itself as well as everything under it. That was fine while nothing lived at the root. The second line was an exception I'd added for SSH, which had hit the same problem. Once Pages took over the root, the wildcard kept pointing it home.

The rules lived in Pi-hole v6's pihole.toml, in a setting buried under All settings. The Local DNS page only shows exact records, so it looked clean.

$ cat fix

  • Added every internal service as an exact Local DNS record pointing to the proxy, before touching anything else, so nothing went dark.
  • Cleared misc.dnsmasq_lines completely. The SSH exception isn't needed without the wildcard.
  • Confirmed the root now resolves to Cloudflare at home and the services still resolve to the proxy.

$ cat lessons

  • A wildcard plus exceptions is a pattern that keeps growing. The second time I needed a hole punched in it, it was time to drop it.
  • Check where the config really lives. In Pi-hole v6 that's pihole.toml. dnsmasq.conf is generated from it and gets overwritten.
  • Compare your resolver with a public one. Two dig commands narrowed this down faster than anything else.
lab up — · 9 notes ·