Why would a request to a blocked host show up in the upstream resolver logs?

[yoshimo]

My local network runs a Pi-Hole dns resolver that filters requests.
My Phone runs rethinkdns as an always-on VPN. Therefore i assume that if the vpn connection breaks, no connection gets made, no traffic flows.
Since i enabled local filter lists i see log entries in the pihole resolver that say "request to X from my phone was blocked".
The hostname in question is part of an enabled filter list within RethinkDNS.
Shouldn't a dns resolution attempt be already blocked at the local level and never make it to the upstream resolver when you have local filter lists enabled?

[ignoramous]

Do you have any app setup to Bypass DNS or Bypass DNS & Firewall? If so, Rethink will let domain name resolution through and will switch to blocking TCP/UDP connections. This is because, on Android 11 and below, only TCP/UDP connections have ownership information (which app sent the request) tagged.

In v055o (the upcoming version), Rethink will behave differently on Android 12 & above as it implements a full-horizon split-tunnel for DNS (as in, it knows which app is making a DNS request and can serve it depending on a variety of user-set rules and preset factors). In v055o, on Android 11 & below, users will have to turn ON Configure -> DNS -> Advanced DNS filtering (and Split-tunnel DNS) to get a similar behaviour.

Also, if a domain name is Trusted (allowlisted) for a particular app or globally (universally), Rethink will have to switch to blocking/allowing it at TCP/UDP connection time instead of domain name resolution time (which means, a DNS query to resolve that domain name will be sent out).

---

Do you have Configure -> DNS -> DNS Booster turned ON? If so, Rethink may be hydrating its caches (triggering DNS queries) in the background.

---

Another scenario I can think of is, if any app is Excluded from Rethink, then it'll be able to send requests outside of the firewall ("tunnel") Rethink sets up.

To rule this out, you can turn ON Block connections without VPN (if you're on Android 10+) to see if pi-hole then stops reporting blocked domains.

[yoshimo]

There are two exceptions but neither tor browser or the other app that connects to local LAN devices is associated with any of the hosts mentioned in the logfile.
Boosting DNS might be related but still seems wrong behavior. If it is known to be blocked, why would you have to refresh the upstream info?

Block connections without VPN is set to on already.
This runs on Android 14, so i will test again for sure whenever the next release comes out.

[ignoramous]

There are two exceptions but neither tor browser or the other app that connects to local LAN devices is associated with any of the hosts mentioned in the logfile

Confusing. If you have VPN in Lockdown mode ("Block connections without VPN" turned ON), the Excluded apps should not have any connectivity (that's the entire purpose of the Lockdown mode).

If you have those apps setup to Bypass (from within Rethink), then even blocked domains will be resolved (as explained above).

If it is known to be blocked, why would you have to refresh the upstream info?

The cache will refresh only if an existing popular entry has answers that need refreshing. So, you'd see resolution attempts in cases where a popular domain (not all domain are hydrated in the background) is added to blocklist after it has already been cached.