Pi-hole is a DNS sinkhole that intercepts ad and tracker requests before they ever load — across every device on your network, no browser extension required. Smart TVs, phones, game consoles, and IoT devices all benefit without any per-device setup. Here is the complete 2026 process from zero to a running Pi-hole.
What changed in 2026
- Pi-hole v6 released, bringing a rewritten web interface, improved performance, and native HTTPS support for the admin panel without extra config.
- Raspberry Pi 5 is the go-to hardware, though the older Pi 4 and Pi Zero 2 W work perfectly for DNS-only duties.
- AdGuard Home grew as a competitor; both are solid in 2026. Pi-hole has more community blocklists; AdGuard Home has a slightly slicker UI.
- DoT/DoH support improved — Pi-hole can forward to encrypted upstream resolvers (Cloudflare 1.1.1.1, Quad9) out of the box.
What you need
| Item |
Notes |
| Hardware |
Raspberry Pi Zero 2 W (~$15), Pi 4/5, or any Linux machine |
| OS |
Raspberry Pi OS Lite (64-bit) or Ubuntu 22.04/24.04 LTS |
| Storage |
8 GB+ microSD or USB drive |
| Network |
Wired Ethernet recommended; WiFi works |
| Router access |
Needed to change DHCP DNS settings |
Step 1 — Prepare the hardware
Flash Raspberry Pi OS Lite with Raspberry Pi Imager. In the imager settings, enable SSH, set a hostname (e.g., pihole), and configure WiFi if not using Ethernet. Boot, find the IP, and SSH in.
Step 2 — Install Pi-hole
Run the one-line installer:
curl -sSL https://install.pi-hole.net | bash
The interactive wizard asks:
- Network interface — pick
eth0 (wired) or wlan0.
- Upstream DNS — Cloudflare (1.1.1.1) or Quad9 are good defaults. You can change later.
- Blocklists — accept the default StevenBlack list to start.
- Install the web admin interface — yes.
- Log queries — yes (useful for debugging and stats).
At the end, note the admin password displayed. Change it immediately with pihole -a -p.
Step 3 — Give Pi-hole a static IP
Pi-hole must always be at the same IP. Set a DHCP reservation in your router: bind the Pi-hole's MAC address to a fixed LAN IP (e.g., 192.168.1.10).
Alternatively, set a static IP in /etc/dhcpcd.conf on the Pi:
interface eth0
static ip_address=192.168.1.10/24
static routers=192.168.1.1
static domain_name_servers=127.0.0.1
Step 4 — Point your router's DNS to Pi-hole
Log into your router admin panel. Under DHCP/DNS settings:
- Primary DNS: Pi-hole's static IP (e.g.,
192.168.1.10)
- Secondary DNS: leave blank or repeat the Pi-hole IP — avoid adding a fallback like 8.8.8.8 or devices will bypass Pi-hole when it's down.
Every device that renews its DHCP lease will now use Pi-hole as its DNS resolver.
How to pick blocklists
| List |
Domains blocked |
Use case |
| StevenBlack (default) |
~120k |
Good all-rounder, low false positives |
| OISD Full |
~1.5M |
Aggressive, catch-all |
| oisd.nl (small) |
~50k |
Light, conservative |
| HaGeZi Pro |
~700k |
Strong tracker focus |
| No Google |
varies |
Block all Google tracking |
Start with StevenBlack only. Add OISD Full once you've confirmed nothing important breaks. Visit Settings → Blocklists → Update Gravity to apply new lists.
Optional: pair with Unbound for recursive DNS
Unbound makes Pi-hole its own recursive resolver — no upstream DNS provider sees your queries. Install it:
sudo apt install unbound -y
Configure Pi-hole to use 127.0.0.1#5335 as its custom upstream DNS. The Pi-hole docs have the exact unbound.conf snippet.
Common mistakes
Adding too many blocklists immediately. You will break legitimate services and waste hours debugging. Add one list at a time.
Not setting a static IP. If Pi-hole's IP changes, every device on the network loses DNS. Reserve the IP in your router.
Adding a fallback DNS. If you add 8.8.8.8 as a secondary, devices fall back silently when Pi-hole restarts — you lose all blocking and logs.
Ignoring the query log. The admin panel's query log shows exactly what is being blocked. It is your fastest debugging tool when something breaks.
What to skip
- Running Pi-hole on your main desktop — if you restart the machine, your whole network loses DNS. Use a dedicated low-power device.
- The Pi-hole DHCP server unless your router's DHCP is unusable — fewer moving parts is better.
- Blocking everything in the 100k+ domain range if you have family members or work VPNs on the network — the whitelist workload spikes fast.
FAQ
Will Pi-hole block YouTube ads?
No. YouTube ads are served from the same domains as the video content — DNS blocking cannot distinguish them. You need a browser extension like uBlock Origin for that.
What percentage of requests does Pi-hole typically block?
10–30% for most households, higher if you have IoT devices or smart TVs. Check your dashboard after 24 hours.
Pi-hole vs AdGuard Home — which should I use in 2026?
Both work well. AdGuard Home has a cleaner UI and built-in DoH/DoT client. Pi-hole has more community blocklist resources and a larger forum. Either is a good choice.
What happens if Pi-hole goes down?
All DNS on your network fails until it recovers or you update your router's DNS settings. A second Pi-hole instance (failover) or a UPS for the Pi solves this.
Where to go next