How to block a domain and all its subdomains?

[I4LYT]

I am trying to block lightspeedsystems.com(don't ask why) and all of its subdomains. How do I do this?

[billz]

The method described here is the best approach, but you can take extra steps to ensure it's blocked completely. If you only have one domain (and all subdomains) to block, edit the main adblock config directly with sudo nano /etc/dnsmasq.d/090_adblock.conf and add this to the end:

address=/lightspeedsystems.com/0.0.0.0

In RaspAP's DHCP Sever > Advanced tab, select "Only ever query DNS servers configured below" and choose a custom or hosted server (for example, 9.9.9.9). This adds no-resolv to the dnsmasq configuration, which tells your router to stop using /etc/resolv.conf for upstream DNS. Be sure to restart the dnsmasq service.

Install the bind9-dnsutils package, then test the config from your router's shell:

sudo apt install bind9-dnsutils -y

nslookup lightspeedsystems.com 10.3.141.1
Server:		10.3.141.1
Address:	10.3.141.1#53

Name:	lightspeedsystems.com
Address: 0.0.0.0

This shows that dnsmasq is blocking correctly by returning 0.0.0.0.

If you can still access the domain when connected to the AP, usually this means your client is using a different upstream DNS server. On macOS, running scutil --dns shows this:

DNS configuration

resolver #1
  nameserver[0] : 1.1.1.1
  nameserver[1] : 8.8.8.8
  flags    : Request A records, Request AAAA records
  reach    : 0x00000002 (Reachable)
  order    : 200000

So despite being connected to RaspAP, my laptop will use Google and Cloudflare's DNS until I change this.

Many Android devices use "Private DNS" (DNS-over-TLS) which bypasses your local DNS server. Firefox also uses DNS over HTTPS (DoH). Check your DNS settings on each client device. In this example, blocking worked for this domain and subdomains on my phone when connected to RaspAP. DNS leak tests like https://browserleaks.com/dns and https://www.dnsleaktest.com/ will help you troubleshoot this.

tl;dr: modern clients actively bypass local DNS; this affects RaspAP (and Pi-hole) users in the same way.