Labthrift Labthrift What to buy. What to skip. Why.

Written 6 Sep 2026. This is a how-to, not a product card.

When ads sneak past on IPv6

Pi-hole looks fine on IPv4, but phones still show banners. Check whether the house still hands out IPv6 DNS past the computer, then fix the router or turn IPv6 DNS off for now.

Haven't installed Pi-hole yet? Start with the first useful thing. Ads back for everyone and you have not checked power or router DNS yet? Start with when ads come back. This note is the quieter trap: IPv4 DNS points at the computer, but the house still gives out IPv6 DNS from the ISP, so phones look up ads on a path Pi-hole never sees.

Skip until IPv4 DNS already looks right

Confirm the computer is on and Pi-hole answers. Confirm the router LAN or DHCP DNS still uses this computer's IPv4 address. Brand menus: point common home routers at Pi-hole. If that walk is unfinished, finish it first. Don't buy a mesh kit for IPv6.

What this is

Many ISP gateways and home routers enable IPv6 by default. Phones and laptops get a second address book for names over IPv6. You fixed the IPv4 book (Pi-hole). The IPv6 book still points at the ISP. The device prefers that second book for some lookups, and banners return even while the Pi-hole query log looks calm. The calm first-timer fix is usually: point IPv6 DNS at the computer too, or turn IPv6 DNS (or LAN IPv6) off on the router until you care.

Step 1: prove IPv4 is clean and the phone is not

On a phone that still shows ads, open a site that used to be dirty. On a laptop that looks clean, check the Pi-hole query log (admin page, or SSH):

pihole -t

Or open http://pi.hole/admin and watch Query Log. If the dirty phone barely appears while a clean laptop floods the log, that phone is asking someone else for names. If only one phone is dirty and Private DNS / Private Relay / a VPN is on, that is still when one phone still shows ads. Come back here when those are off and ads remain.

Step 2: see whether the phone has IPv6 DNS that is not Pi-hole

On iPhone: Settings → Wi-Fi → the i next to the house network. Look for IPv6 Address and DNS. On Android: Wi-Fi details for the house network; look for IPv6 and DNS (wording varies by maker). Write down any DNS that is not the computer's IPv4 address and not a Pi-hole IPv6 address you set on purpose. ISP-looking DNS (or “Automatic” while IPv6 is up) is the usual smoking gun.

No IPv6 section and no IPv6 address on the phone? This may not be your night. Go back to when ads come back or the one-device notes. You don't need to invent IPv6 problems.

Step 3: see if the computer even has an IPv6 address

SSH into the computer:

ip -6 -br addr

Look for a global or ULA address on the house interface (not only ::1). No usable IPv6 on the computer? You cannot point the house at an IPv6 Pi-hole yet. Use Step 5 (turn IPv6 DNS or LAN IPv6 off on the router) instead of inventing an address. Pi-hole still works for IPv4.

Step 4: prefer pointing IPv6 DNS at Pi-hole

If the computer has a stable IPv6 address and Pi-hole is running, put that address in the router's IPv6 DNS / DHCPv6 / Router Advertisement DNS fields the same way you set IPv4 DNS. Primary IPv6 DNS = the computer. Leave secondary blank or use the same address if the menu demands two. Exact labels vary; common places are IPv6, LAN IPv6, DHCPv6, or “IPv6 DNS server.” The IPv4 walk for brand menus is point common home routers at Pi-hole — look for the IPv6 twin of that screen.

On the computer, confirm Pi-hole is listening:

pihole status

Then from a laptop on house Wi-Fi, forget the Wi-Fi network and join again (or toggle airplane mode) so leases renew. Browse the dirty site on the phone again.

Step 5: if the router will not take IPv6 DNS, turn that path off

Nest, Google Wifi, and some ISP gateways are rude about custom IPv6 DNS. First-timer calm choice: disable IPv6 on the LAN, or disable DHCPv6 / router advertisements that hand out ISP DNS, so devices stop getting a second book. Names then go through the IPv4 Pi-hole path you already set. Streaming and banking still work for almost every house on IPv4 alone tonight.

Don't disable the whole internet. Don't factory-reset the gateway for this. If the menu only offers “IPv6 on/off,” off on the LAN side is the blunt fix. Re-enable later when you want to set real IPv6 DNS.

Step 6: match what you see

Match the symptom before you buy anything:

What you seeLikely cause
Router IPv4 DNS wrong or automaticNot this page yet. When ads come back / common router DNS.
One phone; Private DNS / Relay / VPN onWhen one phone still shows ads.
Phone has IPv6 DNS ≠ Pi-hole; IPv4 DNS is Pi-holeIPv6 bypass. Steps 4–5.
Computer has no IPv6 addressCan't point IPv6 DNS at it. Step 5 (turn IPv6 DNS/LAN IPv6 off).
Guest Wi-Fi still dirty; main Wi-Fi cleanWhen guest Wi-Fi still shows ads.
After ISP swap, everything dirty againWhen the ISP swaps your router — then re-check IPv6 DNS.

What this is not

This is not a reason to buy a new router or a Raspberry Pi. It is not a full IPv6 redesign of the house. It is not Unbound, a second Pi-hole, or opening Pi-hole to the internet. It is pointing the second address book at the same computer, or closing that book until you care.

What next

When banners drop again, leave the router alone for a week. Watch the log sometimes: see what Pi-hole blocked. If a bank or login breaks, that is when a site won't load after Pi-hole. Keep lists fresh: keep Pi-hole updated. Before a scary change, save a Pi-hole backup. Tired of typing the number? Add a local name in Pi-hole.

Skip

Sources

Pi-hole docs. Pi-hole: upstream DNS. Official pages only. For install, see the first useful thing. For the house-wide checklist, see when ads come back. For IPv4 brand menus, see point common home routers at Pi-hole.

Also on this topic

When ads come backAds are back, sites won't load, or a phone still shows banners. Check the computer, Pi-hole, router DNS, then the phone. When one phone still shows adsEveryone else's ads dropped. One phone still shows banners. Check Private DNS, Private Relay, a VPN, then the Wi-Fi lease. You don't need a new router. When one laptop still shows adsEveryone else's ads dropped. One laptop (or one browser) still shows banners. Check Chrome, Edge, or Firefox Secure DNS, Windows encrypted DNS, Mac Private Relay, then a VPN. You don't need a new router. When guest Wi-Fi still shows adsGuest Wi-Fi is a separate network on purpose. Leave guests on ISP DNS, put a visitor on the main house Wi-Fi, or point guest DNS at Pi-hole only if they can reach the computer. You don't need a new router. Point common home routers at Pi-holeWhere to set DNS on TP-Link, ASUS, eero, Netgear, Nest, and ISP gateways so the house asks Pi-hole. Prefer LAN DHCP DNS. You don't need a new router. The first useful thingPut a house-wide ad block on the old PC. The rest of the house keeps using the internet as usual. You don't need a Raspberry Pi. See what Pi-hole blockedOpen the query log (or watch it over SSH) so you can tell ads are dying, which device asked, and which name to allow later. You don't need a new router. When a site won't load after Pi-holeA bank, streamer, or login page breaks after Pi-hole. Pause blocking for five minutes, then allow the domain you need. You don't need a new router. When the ISP swaps your routerTech left a new gateway (or reset yours). Ads are back, and SSH may miss the old address. Re-find the computer, re-point DNS, re-do the reservation. You don't need a new router or a new Pi-hole. Point a phone or laptop at Pi-hole when the router won'tWhen Nest, Google Wifi, or an ISP gateway will not take custom DNS, set DNS on one phone or laptop so it asks Pi-hole. You don't need a new router for this device.