Glossary

Every term this interface uses that it did not invent, and the few it did.

everyoneAssumes a home network and that you have heard of DNS.page 22 of 24

Terms this interface uses, including the few it invented. Anything with a precise meaning in DNS keeps that meaning here.

DNS#

A / AAAA#: The record types that map a name to an IPv4 and an IPv6 address. A resolver typically answers both for the same name moments apart, which is why one lookup often appears as two rows.
HTTPS (record type)#: A newer record carrying connection hints, including whether a host supports HTTP/3. Apple and Chrome devices ask for it constantly; it is the third most common type on most home networks.
PTR#: Reverse lookup: address to name. Almost always chatter from local service discovery rather than anything a person did.
NXDOMAIN#: The name does not exist. Routine in small quantities: typos, stale configuration, and software probing for names that were never registered.
SERVFAIL#: The resolver could not get an answer. Unlike NXDOMAIN this usually means something is wrong, and a rise in it is normally an upstream in trouble.
Upstream#: The resolver AdGuard HomePi-hole forwards to when it cannot answer from cache. Quad9, Cloudflare and Google are the common ones.
DoH / DoT / DoQ#: DNS over HTTPS, TLS and QUIC. Encrypted transports. Used by AdGuard HomePi-hole they are good; used by a device to reach a different resolver, they are a way around your filtering.
Canary domain#: use-application-dns.net. Firefox looks it up and disables its own DoH if the answer is blocked, which is why blocking it is the correct configuration.
eTLD+1 / registrable domain#: The part of a hostname somebody could register: doubleclick.net out of stats.g.doubleclick.net. Used for grouping, never for a security decision.
TTL#: How long an answer may be cached. A low TTL means more lookups for the same name, which is why some very ordinary services appear near the top of a ranking.

Your network#

DHCP#: How your router hands each device its network settings when it joins, including which DNS server to use. Pointing the network at your resolver is a change to the router’s DHCP settings, and it is the step no installer can do for you.
Port 53#: The port DNS runs on, by long-standing convention. Only one program on a machine can listen there, which is the whole of the trouble below.
systemd-resolved#: A small DNS stub running by default on most modern Linux distributions. It occupies port 53, so it has to be moved aside before AdGuard HomePi-hole can listen there. The installer detects this and offers to do it; Troubleshooting covers what the change actually does.Pi-hole’s own installer will have dealt with this already, so it is background rather than a step you have to take.
arm64#: The 64-bit ARM processor architecture a Raspberry Pi 4 or 5 runs, also called aarch64. Distinct from the older 32-bit ARM, which no image is built for.uname -m tells you which you have.

AdGuard Home#

Filter list#: A subscribed list of blocking rules. AdGuard Home credits the first list that matched, which is why per-list hit counts flatter whichever list happens to be first.
Blocked service#: A coarse switch (TikTok, Netflix) that expands to a set of rules AdGuard Home maintains.
Rewrite#: Answering a name yourself with an address you choose. Applies to the whole subtree, which is the part that surprises people.
Client#: AdGuard Home’s word for a device: either a LAN address or a ClientID announced by an encrypted-transport client.
Query log#: The circular buffer this product reads. Sized in entries, so it holds hours rather than days.

Pi-hole#

FTL#: Faster Than Light, the daemon that actually answers DNS and keeps the query database. When this wiki says Pi-hole reports something, FTL is what reported it.
Adlist#: Pi-hole’s word for a subscribed list of blocking rules — what AdGuard Home calls a filter list.
Group#: A set of clients with their own adlists and rules. Pi-hole has this and AdGuard Home has no equivalent, which is why it appears in no control screen here.
Local DNS record#: Answering a name yourself with an address you choose — Pi-hole’s equivalent of a rewrite.
Client#: Pi-hole’s word for a device: a LAN address, usually accompanied by the hostname FTL reverse-resolved for it.
Query log#: FTL’s own database of queries, sized in days rather than entries and defaulting to a year. Unlike AdGuard’s ring buffer it is real history — see why history is the whole argument for what that changes.
Application password#: A revocable credential generated under Settings → Web interface / API. Preferred over the web password: it can be revoked on its own and it works with 2FA.

This product#

Rollup#: An hourly aggregate that survives retention. Five grains: totals, per-device, per-domain (capped), per-country, per-company.
Coverage#: How far back the data actually goes, stated rather than implied. Detail has one floor and rollups have an earlier one.
Episode#: Consecutive lookups of one name by one device, each within a few seconds of the last. Friction counts episodes, not queries.
Retry#: Any lookup after the first within an episode. A client that did not accept the answer.
Shape (loop / recurring / occasional)#: How an episode’s retries are distributed. Loop is one stuck client; recurring happens every time the thing is used.
Moment#: One device, one instant, and every lookup either side of it. The answer to “why did this break just now”.
Pace#: How fast the live layers move: calm, steady or live. It retimes the stream, the map and every transition at once.
Watermark#: The newest row already stored. Where catch-up stops walking backwards.
Enrichment#: Turning raw log values into things you recognise: an address into a named device, a hostname into the company behind it, an answer into a country. Four reference files on disk, consulted locally; nothing is ever looked up online.
Dedupe#: Recognising a record already stored, so re-reading a page of the log adds nothing rather than counting it twice. Identity is a digest of (time, client, domain, qtype) held UNIQUE, which makes it a property of the schema rather than of the poller’s timing.
WAL#: SQLite’s write-ahead log. Readers and the writer stop blocking each other, and commits batch instead of forcing a flush to disk each time — which is what makes running on an SD card survivable.
Reticle#: The pointer layer that reads what is under it. Off automatically on touch screens and under reduced motion.