$ sqlite3 pihole-FTL.db
> select domain,client
  from queries...
> .mode csv
> .output queries.csv
Guides / Pi-hole

Detect AI usage with Pi-hole query logs

Pi-hole logs every DNS query on the networks it serves, for free, on hardware you already own. That makes it the most accessible shadow AI sensor there is, from homelab to school lab to small office.

Layer: DNS
Identity: client IP, per device
Format: plain list or CSV
Cost profile: free sensor, free preview
Run a free audit on a Pi-hole export
shadow-ai-audit.pdf Cover of the sample Shadow AI audit report prepared for an example company, with its headline findings. Sample report View all 11 pages Opens in your browser · PDF
Getting the data out

Three export paths, pick the one you like

Pi-hole keeps the long-term record in its FTL database and the recent tail in a log file. All three paths below produce an upload the audit parses without configuration.

The database query

Select timestamp, client and domain from the queries table over your window, output as CSV. The hero shows the shape. Best history depth, cleanest columns.

The log tail

The plain query log file parses too: the audit reads hostname-per-line content even with dnsmasq noise around it. Fastest when you just want this week.

The web UI

The long-term data view exports over a date range from the browser. Zero command line, right for the lab assistant who inherited the box.

No pre-cleaning needed: unparseable lines are skipped and counted, and even a bare list with one hostname per line is a valid upload. Keep the client column if you want the per-device table.

The lines

What a Pi-hole export looks like

# CSV from the FTL database timestamp,client,domain 1789461121,"10.0.20.31","chatgpt.com" 1789461155,"10.0.20.31","quillbot.com" 1789461198,"10.0.20.44","brainly.com" 1789461242,"10.0.20.17","character.ai" 1789461305,"10.0.10.5","huggingface.co" 1789461377,"10.0.20.44","cdn.jsdelivr.net"

Unix timestamps are fine; the parser reads them. Client IPs become the per-device sources.

Make IPs mean something first

  • With DHCP reservations or static leases, 10.0.20.31 is "lab seat 31" forever, and every future report gets more readable.
  • Without them, note the lease table's state on export day alongside the report.

Subnets are your segments

  • Lab, staff and guest VLANs show up as IP ranges, so segment-level reading works even with zero name mapping.
  • That is usually the grain a school or homelab actually needs.
Worked scenario

A school computer lab, one term of DNS

A secondary school runs Pi-hole for the 30-seat computer lab and the staff network. The IT teacher exports a term's worth of lab queries. Sample data.

EXPORTOne term, lab subnet only

A database query filtered to the lab's 10.0.20.0/24 range: 88,000 rows. Staff and guest stay out of scope on purpose, keeping the question clean: what do lab machines reach?

RESULT13 AI tools, two clusters

Cluster one is expected: chatbots and homework-helper tools on most seats, hits spiking in free periods. Cluster two is the finding: a companion-chatbot domain and an image generator with NSFW capability, each concentrated on a couple of seats.

READSeats, not students

Client IPs identify machines, and that is enough. Seat 17's evening character-chat sessions overlap the robotics club's lab access, which narrows the conversation without naming anyone from DNS data alone.

ACTIONPolicy with evidence

The two abusive-flagged domains go into Pi-hole's blocklist the same day. The homework tools go to the staff meeting as a teaching-policy question rather than a blocking one.

The report PDF gives the head teacher a dated inventory for the next governors' meeting, which had AI on the agenda anyway.

Education networks sit under age-appropriateness duties that make the abusive-purpose tile the first thing to check. It is the same tile a company checks, with higher stakes.

Homelab to office

The same loop at three scales

Pi-hole audiences run the spectrum. The audit reads the same; what changes is the question you ask it.

Homelab

"What is my smart TV and my family actually talking to?" Run the free preview quarterly and enjoy being the most informed household on the street.

School or club

"What do shared machines reach, and is any of it age-inappropriate?" Segment by subnet, check the abusive tile first, keep the PDF for the governors.

Small office

"Which devices lean on AI tools, and do any train on our data?" Reservations plus a monthly preview covers a 30-person office with no other tooling.

Output

What the report returns for a Pi-hole export

Report sectionWith a Pi-hole export
Summary tilesFull totals for the scope you exported: tools, high-risk, training exposure, abusive, unsanctioned.
Tool tableEvery matched domain with category, risk, sovereignty and dated training verdicts.
Per-device tableClient IPs as sources, with tool counts and hits per device or seat.
Blocked evidenceIf you export status columns, already-blocked queries stay visible as policy evidence.
CSV + PDFFull-report tier; the preview alone covers most homelab questions.

The upload is read once and discarded. Reports live 90 days, deletable earlier. For school data-handling reviews: hostnames, IPs and timestamps go in, nothing else, and nothing persists but the report you keep.

Pi-hole edges

Self-hosted details that shape the results

Caching and CNAMEs

  • Client-side caches mean hit counts are floors, as with all DNS sources.
  • Pi-hole logs the queried name; CNAME chains to AI backends are handled by the register's depth-aware entries.

DoH bypass is real on modern devices

  • Browsers and phones with their own DoH skip Pi-hole entirely.
  • Blocking known DoH resolvers at the firewall, a standard Pi-hole companion move, keeps the sensor honest.

Retention is yours to set

  • FTL's database keeps what you configure. Check depth before promising a term's audit.
  • Export promptly after each period ends; the file is small and the habit is cheap.

Multiple Pi-holes merge fine

  • Concatenate CSVs from both instances; client IPs keep devices distinct.
  • Caps: 5,000 lines / 2 MB free, 2,000,000 lines / 25 MB full.

Open the sample report first

Ten pages of sample data show what your query log turns into: the exposure index, verdicts, the per-device table. Useful for convincing whoever signs off on the lab policy.

Open the sample PDF
Beyond the lab

Pi-hole audit use cases beyond home labs

Pi-hole is not just a hobbyist tool. Several deployment patterns produce audit-ready data at organizational scale.

School networks

Pi-hole on the school DNS server captures all student and staff queries. Per-client IP mapping against DHCP reservations provides classroom-level or role-level attribution. Quarterly reports feed acceptable-use policy reviews.

Small office

A Raspberry Pi running Pi-hole is a zero-cost DNS filter for offices under 50 users. The query log becomes a complete audit source. No enterprise firewall needed for shadow AI discovery.

Guest and IoT segments

Point guest and IoT VLANs at a dedicated Pi-hole instance. The query log reveals AI tool usage on unmanaged devices that bypass the corporate proxy entirely.

Pi-hole's gravity list blocks ads. The audit's CSV-exported hostnames extend that list to AI-specific domains, turning the ad blocker into a shadow AI blocker with one import.

FAQ

Pi-hole export questions

Which Pi-hole export is best?

The FTL database query as CSV for depth and clean columns; the log file or web export when you want zero friction. All three parse automatically.

Can the audit identify students or family members?

No. Pi-hole identities are client IPs, so attribution is per device or seat. Mapping devices to people is a local decision outside the audit.

Is a plain list of domains enough?

Yes. One hostname per line is a supported format; you get the full tool inventory without a per-device table.

Does Pi-hole's own blocking overlap with this?

Pi-hole blocks what its lists know. The audit inventories what was actually queried, adds dated training verdicts, and its findings often become your next blocklist entries.

What does this cost a school or homelab?

The preview is free: 1 a day, 3 a month, 5,000 lines each. A full report is $99 once, which for the school was the term's entire audit budget. See pricing.

How is this different from watching the Pi-hole dashboard?

The dashboard shows top domains; the audit classifies them: which are AI, what risk, what training terms, dated. It answers the question the dashboard makes you guess at.

The follow-up

Turning findings into Pi-hole configuration

Pi-hole gives you three levers, and the report tells you which domains deserve which one.

Exact-domain blocks

Block-verdict domains from the report CSV go in as exact blacklist entries. Surgical, reversible, and visible in the next audit as attempts-only rows.

Regex for families

A tool with many regional subdomains gets one regex entry instead of a dozen exact ones. The report's hostname list shows you the pattern to write.

Group management for segments

Lab machines get the strict policy, staff gets the moderate one. The audit's per-subnet reading tells you whether the split is working, per group, per term.

Term calendar

An audit cadence that matches the school year

Networks with term rhythms should audit on term boundaries, not calendar months. The pattern that worked in the scenario:

Week 1 of term: baseline

  • Free preview on the first full week. New devices and new habits show immediately after a break.
  • Screenshot the tiles for the term's first staff meeting.

Mid-term: spot check

  • Second free preview, same subnet scope. Compare the abusive tile and the new-tools list against week one.

End of term: the full report

  • One $99 report over the whole term for the permanent record and the governors' pack.
  • Blocklist updates land during the break, when nothing disrupts lessons.

Any incident: targeted window

  • A concern about a specific week gets its own narrow export. Small windows keep the question and the answer aligned.

Three previews a month means the term cadence fits entirely inside the free tier, with the paid report only where the paper trail needs it.

Your Pi-hole has been logging the answer all along

One SQLite query or one file download, then a free upload. The school found its findings in an afternoon; a homelab takes minutes.

Run the free audit