The traditional DNS system’s lack of encryption has long been a critical weakness, exposing users to surveillance, spoofing, and data manipulation [21] . Studies reveal that 78% of ISPs log DNS queries, enabling mass tracking of user activities [26] , while DNS hijacking attacks increased by 48% in 2023, costing organisations $1.2 million per breach on average [24] . These vulnerabilities stem from DNS’s design in the 1980s, which prioritised speed over security, leaving it susceptible to modern threats like man-in-the-middle attacks [17] .

Contrastingly, proponents of unencrypted DNS argue that it simplifies troubleshooting and compliance with legal interception requirements [29] . However, empirical evidence shows that 62% of cyberattacks exploit DNS weaknesses, undermining such claims [3] . For instance, in Nigeria and India, unencrypted DNS has facilitated state-sponsored censorship and ad fraud, worsening digital inequities [28] . This dichotomy highlights the urgency of adopting encrypted alternatives like DoH, which encrypts queries to mitigate risks [22] . The literature consensus is clear: DNS encryption is no longer optional but a necessity in an era of escalating cyber threats [4] .

DoH addresses DNS vulnerabilities by tunnelling queries through HTTPS, preventing eavesdropping and manipulation [1] . Major browsers like Firefox report a 44% reduction in user tracking after DoH adoption [30] , while Cloudflare’s implementation thwarted 89% of spoofing attacks in controlled tests [11] . Such successes underscore DoH’s role in enhancing privacy, particularly in regions with oppressive internet regimes [16] . Critics, however, warn of centralisation risks, as most DoH traffic relies on a few providers like Cloudflare, creating single points of failure [24] .

Alternative protocols like DNS over TLS (DoT) offer similar encryption but face slower adoption due to compatibility issues [9] . Comparative studies show DoH’s superiority in bypassing network-level censorship, as it mimics regular HTTPS traffic [19] . For example, during Iran’s 2022 internet shutdowns, DoH-enabled devices maintained access while traditional DNS failed [16] . Despite its benefits, DoH’s deployment remains contentious, with ISPs resisting its erosion of their monitoring capabilities [32] . This tension between privacy and control is a recurring theme in the literature, with DoH emerging as a compromise that prioritises user security [12] .

Excessive advertisements consume 21% - 35% of network bandwidth, slowing performance and inflating costs [23] . Pi-hole mitigates this by blocking ad-serving domains at the DNS level, reducing data usage by 30% - 40% in deployments like European universities [13] . Case studies demonstrate its efficacy: the New York Times’ webpage load times improved by 36% after Pi-hole blocked ad requests [7] . Such savings are critical in low-bandwidth regions, where ads drain limited data plans [25] . Critics argue that Pi-hole’s manual blocklist updates are cumbersome, but automation tools are increasingly addressing this gap [14] .

Pi-hole’s benefits extend beyond bandwidth conservation. By blocking malicious ad networks, it reduces malware infections by 51% in healthcare networks [20] . However, over-blocking can disrupt legitimate services, a challenge noted in 12% of implementations [35] . Comparative analyses show Pi-hole outperforms browser-based ad blockers, which fail to filter traffic from non-browser apps [8] . For instance, Indian mobile users reported 28% faster speeds after deploying Pi-hole network-wide [28] . The literature thus positions Pi-hole as a scalable solution for both bandwidth optimisation and security, albeit with room for refinement in list curation [13] .

The combined deployment of DoH and Pi-hole offers a robust solution for enhancing both security and bandwidth efficiency. Studies demonstrate that while DoH encrypts DNS queries to prevent interception, Pi-hole blocks malicious ads and trackers, reducing unnecessary data consumption by 30% - 40% [7] . For example, a German university network reported 37% lower bandwidth usage after integrating both technologies, alongside a 51% drop in malware incidents [13] . This synergy addresses two critical challenges simultaneously: privacy protection and network performance optimisation. Critics argue that such integrations may complicate network management, but empirical evidence suggests otherwise. Automated tools now streamline configuration, making deployments feasible even for non-technical users [8] .

However, challenges persist in balancing security with functionality. Some services rely on ad revenue, and aggressive blocking can disrupt legitimate platforms [35] . Comparative analyses reveal that custom blocklists (e.g., Firebog’s curated lists) mitigate over-blocking while maintaining high efficacy [13] . Additionally, enterprises using Pi-hole with DoH report 28% faster page loads and reduced exposure to phishing attacks [20] . The literature thus highlights the practicality of this integration, particularly for organisations prioritising both security and operational efficiency. Future research should explore scalable models for large networks, as current studies focus predominantly on small to medium setups [24] .

Despite their benefits, DoH and Pi-hole face adoption barriers, including technical, policy, and usability hurdles. Technical challenges include compatibility issues with legacy systems, where older routers and devices may not support DoH or container-based Pi-hole installations [14] . For instance, a 2023 study found that 23% of UK SMEs delayed DoH adoption due to hardware limitations [32] . Policy conflicts also arise, as ISPs and governments resist encrypted DNS for surveillance and data retention purposes [16] . In India, regulatory pushback against DoH has slowed its rollout, despite proven security advantages [28] . These obstacles underscore the need for standardised protocols and policy advocacy to promote wider adoption.

Solutions are emerging to address these challenges. Middleware solutions, such as DoH proxies, enable compatibility with legacy systems, bridging the gap for older infrastructures [24] . For Pi-hole, community-maintained blocklists (e.g., Firebog) reduce manual curation efforts, while APIs enable real-time updates [13] . Case studies from European universities show that training IT staff on DoH-Pi-hole integration cuts deployment time by 40% [7] . The literature suggests that while challenges exist, they are not insurmountable. Strategic planning, stakeholder education, and iterative testing can overcome most barriers, making these technologies accessible to a broader audience [29] . Future studies should focus on cost-benefit analyses to justify investments in these solutions for resource-limited settings [25] .

The study aligns with three key theoretical frameworks: Privacy-Enhancing Technologies (PETs), Resource Conservation Theory, and Cybersecurity Resilience Theory. PETs justify DoH’s encryption model, emphasising user autonomy and data minimisation [16] . For example, DoH’s design ensures that only the resolver and user access query content, aligning with PETs’ core principles [4] . Resource Conservation Theory explains Pi-hole’s role in bandwidth optimisation, framing data as a finite commodity to be managed efficiently [17] . Hospitals using Pi-hole conserved 15% - 20% of bandwidth, reallocating resources to critical services [20] . These frameworks provide a lens to evaluate the technologies’ broader societal impact, beyond technical metrics.

Cybersecurity Resilience Theory unifies these concepts, advocating for multi-layered defences against evolving threats [18] . Integrated DoH-Pi-hole systems exemplify this by combining encryption (DoH) and threat filtering (Pi-hole) to create adaptive security postures. For instance, a 2023 enterprise case study showed that such systems reduced phishing susceptibility by 44% while improving network speed [30] . Critics argue that resilience frameworks often overlook usability trade-offs, but empirical data counters this. User-friendly implementations, like Docker-based Pi-hole, demonstrate that security and efficiency can coexist without sacrificing accessibility [8] . The literature thus positions these frameworks as essential for guiding future research, particularly in developing economies where both security and resource constraints are acute [25] .

The efficacy of DoH and Pi-hole is best demonstrated through real-world implementations across diverse settings. Globally, Mozilla’s integration of DoH in Firefox reduced user tracking by 44%, while enterprise deployments showed a 36% decrease in DNS-based attacks [30] . In continental contexts, European universities using Pi-hole reported 37% bandwidth savings and improved network performance, particularly in ad-heavy environments [13] . National-level case studies further validate these findings; Indian hospitals leveraging Pi-hole alongside DoH saw 51% fewer malware infections and 28% faster page loads [20] . These examples highlight the technologies’ adaptability to different infrastructures, from small home networks to large organizational systems.

However, disparities exist in adoption rates and outcomes based on regional and economic factors. Developing nations face unique challenges, such as limited technical expertise and regulatory resistance to encrypted DNS [28] . For instance, while Pi-hole is widely adopted in North America and Europe, its use in African and South Asian countries remains limited due to infrastructure constraints [25] . Comparative analyses reveal that customized deployments—such as using localized blocklists or hybrid DoH resolvers—can address these gaps [13] . The literature thus emphasizes the need for context-specific implementations, particularly in low-resource settings where both security and bandwidth conservation are critical [29] . Future research should explore cost-effective scaling models to bridge these disparities.

Despite the proven benefits of DoH and Pi-hole, significant gaps persist in the literature. First, there is a lack of holistic studies examining their combined impact on both security and bandwidth efficiency [35] . Most research focuses on either technology in isolation, overlooking their synergistic potential. Second, scalability remains understudied, particularly for enterprise-level networks and developing regions with limited infrastructure [24] . For example, only 12% of published works evaluate large-scale deployments, leaving a void in practical guidance for IT administrators [35] . These gaps hinder the development of standardized best practices, resulting in fragmented implementations.

Addressing these gaps requires multi-disciplinary research integrating technical, policy, and usability perspectives. Future studies should prioritize longitudinal analyses of DoH-Pi-hole deployments to assess sustainability and evolving threat mitigation [19] . Additionally, cost-benefit frameworks are needed to justify investments in resource-constrained environments [25] . The consequences of inaction are tangible: without scalable solutions, organizations will continue to face trade-offs between security and performance, exacerbating vulnerabilities [24] . By closing these gaps, researchers can empower stakeholders to harness the full potential of these technologies, fostering a more secure and efficient internet ecosystem [16] .

The network environment replicates the MikroTik RouterOS-based deployment described in Section 5 of the attached document, with the following adaptations:

Quantitative and qualitative data are gathered to address the research objectives:

Deployed Mozilla Rally to 200 users (50 each: home, SME, academia, enterprise). Tracked:

Tested 3 blocklist strategies on 1000 domains:

1) Firebog (default).

2) Firebog + CDN allowlists.

3) Firebog + ML (DNSFilter AI).

GNS3-simulated networks (1K - 10K devices) with Pi-hole clusters (3 nodes). Compared to Cisco Umbrella.

Table 1 shows that an observed 38% reduction in bandwidth usage after Pi-hole deployment strongly aligns with prior research, particularly the German university case study that reported 37% savings [13] . This consistency across different network environments reinforces Pi-hole’s reliability as a bandwidth conservation tool. The near-identical results suggest that Pi-hole’s DNS-level ad blocking delivers predictable performance benefits regardless of network scale, validating its widespread adoption potential. The complete elimination of ad traffic (100% blocking) further corroborates existing claims about Pi-hole’s effectiveness against intrusive advertisements and trackers [7] [13] , while the 34% improvement in page load times demonstrates tangible user experience benefits that support earlier qualitative assessments [8] .

However, the study uncovered a notable discrepancy with previous literature regarding content delivery network (CDN) performance. While earlier Pi-hole studies [7] emphasized bandwidth savings without mentioning downstream effects, this research identified a marginal 5% slowdown in non-ad content delivery due to blocked CDN dependencies. This finding suggests that some legitimate services relying on ad-supported CDNs may require manual allow listing, a nuance absent from prior discussions. For enterprise stakeholders, these results highlight both opportunities and implementation considerations—the significant bandwidth savings (averaging 38%) can be reallocated to mission-critical operations like VoIP or cloud backups, but optimal performance may require additional configuration tuning to maintain CDN-dependent services. This balanced perspective advances the literature by providing a more comprehensive view of Pi-hole’s real-world impacts beyond simple ad-blocking metrics.

The results of the field tests in Table 2 confirmed core findings but exposed disparities in ISP’s. Ghana’s higher latency (+6 ms vs. lab) aligns with APNIC’s reports on African ISP throttling [23] . Main-One (ISP)’s 98% hijacking prevention (vs. 100% in lab) reflects localized DNS poisoning attacks [22] , validating DoH’s necessity. Bandwidth savings were 5% - 9% lower in the field due to ISP-injected ads (e.g., MTN’s “promo” domains), corroborating Sandvine’s ad-traffic estimates [24] . These nuances strengthen the study’s external validity while affirming DoH-Pi-hole’s robustness.

In Table 3 , Campus Wi-Fi reported higher DNS failures (2.7/week) due to legacy apps relying on hardcoded DNS, echoing Jacobs University’s findings [31] . Home users’ 41% PLT gains match prior Pi-hole studies [13] , but Faculty Offices/Central Administration results highlight infrastructure dependencies. The 3.8 Campus Wi-Fi satisfaction score (vs. 4.6 Lecture Halls) reflects IT staff’s manual allow listing burden, supporting [35] ’s call for better automation tools.

The results in Table 4 show that ML reduced false positives to 3% (vs. 15% baseline), validating DNS Filter’s hospital trial results [20] . However, CDN allow lists added 2 hrs/month of admin work—consistent with [14] ’s “cumbersome updates” critique. The 8 ms CDN delay with ML (vs. 50 ms baseline) proves hybrid approaches optimize both performance and labour, addressing [35] ’s calls for “dynamic filtering.”

It can be observed from Table 5 that Pi-hole clusters scaled linearly to 5 K devices (+3 ms latency), but Cisco’s 12ms latency at scale confirms [24] ’s “enterprise-grade” claims. However, Pi-hole’s $0.25/device cost (vs. $5 for Cisco) aligns with [34] ’s SME cost analyses. The 5K-device ceiling supports [31] ’s “decentralized Pi-hole” proposal for larger nets.

Table 2 shows that latency comparison between traditional DNS and DNS over HTTPS (DoH), it revealed a modest 12-millisecond increase when using encrypted queries. While this introduces a minor delay, the tradeoff is justified by DoH’s robust security advantages—eliminating eavesdropping risks, preventing DNS spoofing, and safeguarding user privacy. Notably, this latency difference is imperceptible in real-world browsing scenarios, as confirmed by controlled tests

and user experience metrics. The near-negligible performance impact, coupled with DoH’s proven resilience against attacks (100% hijacking prevention in our tests), solidifies its viability for security-conscious deployments. These findings align with global adoption trends, where encrypted DNS has become a baseline standard without compromising usability. For organizations and individuals alike, DoH represents a pragmatic balance between privacy and performance, with delays dwarfed by its critical role in modern threat mitigation.

Figure 1 shows the Pi-hole administration dashboard, showcasing its functionality as a DNS-level network-wide ad blocking solution. The interface presents comprehensive metrics including: 4898 total DNS queries processed, with 4130 (84.3%) successfully blocked by the system’s 319,509-domain blocklist. The configuration panel displays active adlist sources, primarily curated from GitHub repositories, with toggle controls for individual list management. Administrative features are prominently accessible, including query monitoring, domain whitelisting/blacklisting, and detailed traffic analytics through integrated logging. This visualization demonstrates Pi-hole’s capability to provide granular network control while maintaining transparent operation statistics—a critical feature for enterprise deployment where monitoring and customization are paramount. The 84.3% blocking efficiency evidenced here aligns with industry benchmarks for DNS-based ad filtration systems.