Here's the SOLUTION. First of the comments were right. pi-hole alone isn't enough in 2026. here's the complete picture. What pi-hole does: blocks DNS requests at the network level. every device on your network uses it as the resolver. LG tries to call home. pi-hole sees the domain. blocks it. done. What smart TVs do to get around it: LG and Samsung panels hardcode DNS servers into their firmware. 8.8.8.8. 1.1.1.1. they ignore what your router tells them to use. Packet captures confirm Samsung and LG panels open TLS connections to 8.8.8.8:443 within 11 seconds of cold boot. pi-hole never sees those requests. they go straight out. they also use: — DoT (DNS over TLS) on port 853 — encrypted DNS that bypasses your resolver — DoH (DNS over HTTPS) on port 443 — encrypted DNS disguised as normal web traffic The complete solution would be in layers: Layer 1: pi-hole or AdGuard Home on any spare device. a Pi Zero 2W is enough for a household. a mini PC or spare laptop works fine. pull the image, point your router's DHCP DNS to its IP. Layer 2: firewall rule to redirect all port 53 traffic back to pi-hole regardless of what the TV tries to use. this catches hardcoded DNS that ignores DHCP. any router running OPNsense or pfSense can do this. some mid-range consumer routers can too. Layer 3: block DoT. deny all outbound TCP/UDP on port 853. DoT always uses 853. blocking it forces devices to fail over to plain DNS which pi-hole catches. Layer 4: block known DoH bootstrap IPs. you cannot block port 443 entirely (that breaks streaming). instead, build an alias list of known public DoH resolvers — 8.8.8.8, 1.1.1.1, 9.9.9.9 — and deny TCP 443 specifically to those IPs from your TV subnet. Layer 5: VLAN your TV onto its own network segment. it cannot reach your laptops, phones, or NAS. the TV is isolated. whatever it does stays in its lane. On Quad9: Quad9 (9.9.9.9) is a legitimate privacy-respecting DNS resolver. it blocks known malicious domains and doesn't log IPs. it's a good upstream choice for pi-hole itself. but it doesn't solve the problem of TVs bypassing your local resolver entirely. it's where you point pi-hole's upstream, not a replacement for the whole stack. Even with all five layers, ACR (what's on your screen) can still upload fingerprints directly over HTTPS to non-DNS endpoints. pi-hole blocks domains. it cannot inspect encrypted HTTPS payloads. the full solution is: disable ACR in settings first. then add the network layers on top. DNS filtering removes a large share of tracking. not all of it. anyone who says all of it hasn't put a firewall in front of their claims.