Putting Pi-hole in the real network path
I placed Pi-hole where the lab could use it as an actual DNS service rather than a dashboard running on the side. Clients received it through the network configuration, upstream resolution stayed intentional, and pfSense remained the control point for the paths that DNS traffic was allowed to take.
DNS is a behavioral signal
Name-resolution requests can reveal software updates, telemetry, advertising, failed configuration, and devices reaching services you did not know they used.
Blocking is not the whole project
A good setup also needs sensible upstream resolvers, client identification, allowlist discipline, and a plan for what happens when DNS itself becomes unavailable.
The next useful question
Instead of asking only how many domains were blocked, ask which clients changed behavior, which requests repeat unexpectedly, and which services should be monitored elsewhere.
The logs changed how I looked at quiet devices
Devices that appeared idle were often still reaching telemetry, update, advertising, or failed service endpoints. Pi-hole turned those invisible habits into evidence. The value was not blocking the largest number of domains; it was recognizing behavior, testing a theory, and knowing when a request belonged in firewall or monitoring work instead.
Reading DNS without jumping to conclusions
A busy domain in the log is not automatically malicious, and a blocked request is not automatically a victory. Frequency, timing, client identity, and the purpose of the destination all matter. I compare what the device is supposed to do with what its requests actually show before changing a rule.
That process often starts with a single client. I identify it by address and hostname, group its repeated requests, check whether the timing matches an application or scheduled update, and then look for failed retries. A request every few seconds can point to telemetry, a broken configuration, or a service that is being blocked without the device knowing how to recover.
Pi-hole therefore became more than an advertisement blocker. It is an early visibility layer that helps decide where the next investigation belongs. Some findings become allowlist adjustments, some become firewall restrictions, and others become monitoring targets. The important part is keeping the evidence and the decision connected so a future change does not undo the reasoning.