If you run a single DNS server, you will always have downtime when it’s restarted.

The only way to mitigate that, is to run 2 DNS servers.

I setup my network to use pihole as the first DNS and the router as the second, most of the time pihole is used. Unless it’s down

For a critical service like DNS, I decided to set it up bare metal on a Raspberry Pi 2 (even a Pi Zero should work). It’s been working fine for years, I just update it from time to time. That way I can mess with my homelab without worrying about DNS issues.

Running unbound on my opnSense with the appropriate blacklists for ad filtering.

spin up a second pihole docker and upgrade them separately so they can failover to the other one while upgrading. I do not have an issue with 20min lose of DNS after updating my pi.hole docker, but I did spin up a second one when I wanted to try unbound+pi.hole and just kept them both up/running.

I think something else may be wrong if it breaks for 20 minutes. How long does it take for compose to bring the stack up?

Also assuming you run ntpd or chrony, it should always keep your clock in sync.

I am running AdGuard Home DNS, not PiHole… but same idea. I have AGH running in two LXCs on proxmox (containers). I have all DHCP zones configured to point to both instances, and I never reboot both at the same time. Additionally, I watch the status of the service to make sure it’s running before I reboot the other instance.

Outside of that, there’s really no other approach.

You would still need at least 2 DNS servers, but you could setup some sort of virtual IP or load balancing IP and configure DHCP to point to that IP, so when one instance goes down then it fails over to the other instance.

I run my pi-hole on a dedicated Pi, and I pull the updated image first without any trouble. Then after the updated image is pulled, recreating the container only takes a few seconds.

Dunno what’s broken about your setup, but it definitely sounds like something unusual to me.

This is overkill.

I have a dedicated raspberry pi for pihole, then two VMs running PowerDNS in Master/Slave mode. The PDNS servers use the Pihole as their primary recursive lookup, followed by some other Internet privacy DNS server that I can’t recall right now.

If I need to do maintenance on the pihole, power DNS can fall back to the internet DNS server. If I need to do updates on the PowerDNS cluster, I can do it one at a time to reduce the outage window.

EDIT: I should have phrased the first sentence: “My setup is overkill” rather than “This is overkill” - the Op is asking a very valid question and the passive phrasing of my post’s first sentence could be taken multiple ways.

Two lxc’s, one pi 3b.

2 pihole instances 1 pi5 1 pi4 Keepalived provides vrrp at a set address.

Instances kept in sync via orbital

1 goes down the other takes over.

Quite elegantly.

I would do a single instance of Pihole. If you need HA there are ways to do that. If you need something more switch to a proper DNS service.

I run 2 separate adguard home containers on separate hosts and set DNS for both IPs. If I take one down, requests just get sent to the other.

AdguardHome-Sync works great for keeping them in sync

I run Pihole+Unbound, Debian baremetal on a tinypc. RPi was too unreliable. I was too often dealing with issues.

My router is the failback, as it has blocking too.

I’m looking into Technitium, which doesn’t get a ton of attention here. It looks to be much more feature packed than PiHole (DNS over HTTPS, for example), and similar to AdGuard Home.

How do you host your DNS sinkhole/resolver?

Like this, baby:

services.adguardhome = {
      enable = true;
      mutableSettings = false;
      openFirewall = true;
      settings = {
        dns = {
          # Web Interface
          bootstrap_dns = ["9.9.9.9" "149.112.112.112"];
          upstream_dns = ["https://dns.quad9.net/dns-query"];
          fallback_dns = ["tls://dns.quad9.net"];
        };
        filters = [
          {
            name = "AdGuard DNS filter";
            url = "https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt";
            enabled = true;
          }
        ];
        filtering = {
          blocked_services = {
            ids = [
            ];
          };
          protection_enabled = true;
          filtering_enabled = true;
          rewrites = [
          ];
        };

Deploy to the main home server, and the backup instance. NixOS is fucking awesome. No sync tool needed.

I don’t rely on it, but for guests etc I use adblock on OpenWrt with oisd.nl. It’s supposed to have no false positives