Pi-hole logs every DNS query on the networks it serves, for free, on hardware you already own. That makes it the most accessible shadow AI sensor there is, from homelab to school lab to small office.
Pi-hole keeps the long-term record in its FTL database and the recent tail in a log file. All three paths below produce an upload the audit parses without configuration.
Select timestamp, client and domain from the queries table over your window, output as CSV. The hero shows the shape. Best history depth, cleanest columns.
The plain query log file parses too: the audit reads hostname-per-line content even with dnsmasq noise around it. Fastest when you just want this week.
The long-term data view exports over a date range from the browser. Zero command line, right for the lab assistant who inherited the box.
No pre-cleaning needed: unparseable lines are skipped and counted, and even a bare list with one hostname per line is a valid upload. Keep the client column if you want the per-device table.
Unix timestamps are fine; the parser reads them. Client IPs become the per-device sources.
A secondary school runs Pi-hole for the 30-seat computer lab and the staff network. The IT teacher exports a term's worth of lab queries. Sample data.
A database query filtered to the lab's 10.0.20.0/24 range: 88,000 rows. Staff and guest stay out of scope on purpose, keeping the question clean: what do lab machines reach?
Cluster one is expected: chatbots and homework-helper tools on most seats, hits spiking in free periods. Cluster two is the finding: a companion-chatbot domain and an image generator with NSFW capability, each concentrated on a couple of seats.
Client IPs identify machines, and that is enough. Seat 17's evening character-chat sessions overlap the robotics club's lab access, which narrows the conversation without naming anyone from DNS data alone.
The two abusive-flagged domains go into Pi-hole's blocklist the same day. The homework tools go to the staff meeting as a teaching-policy question rather than a blocking one.
The report PDF gives the head teacher a dated inventory for the next governors' meeting, which had AI on the agenda anyway.
Education networks sit under age-appropriateness duties that make the abusive-purpose tile the first thing to check. It is the same tile a company checks, with higher stakes.
Pi-hole audiences run the spectrum. The audit reads the same; what changes is the question you ask it.
"What is my smart TV and my family actually talking to?" Run the free preview quarterly and enjoy being the most informed household on the street.
"What do shared machines reach, and is any of it age-inappropriate?" Segment by subnet, check the abusive tile first, keep the PDF for the governors.
"Which devices lean on AI tools, and do any train on our data?" Reservations plus a monthly preview covers a 30-person office with no other tooling.
| Report section | With a Pi-hole export |
|---|---|
| Summary tiles | Full totals for the scope you exported: tools, high-risk, training exposure, abusive, unsanctioned. |
| Tool table | Every matched domain with category, risk, sovereignty and dated training verdicts. |
| Per-device table | Client IPs as sources, with tool counts and hits per device or seat. |
| Blocked evidence | If you export status columns, already-blocked queries stay visible as policy evidence. |
| CSV + PDF | Full-report tier; the preview alone covers most homelab questions. |
The upload is read once and discarded. Reports live 90 days, deletable earlier. For school data-handling reviews: hostnames, IPs and timestamps go in, nothing else, and nothing persists but the report you keep.
Three pages of sample data show what your query log turns into: tiles, verdicts, the per-device table. Useful for convincing whoever signs off on the lab policy.
The FTL database query as CSV for depth and clean columns; the log file or web export when you want zero friction. All three parse automatically.
No. Pi-hole identities are client IPs, so attribution is per device or seat. Mapping devices to people is a local decision outside the audit.
Yes. One hostname per line is a supported format; you get the full tool inventory without a per-device table.
Pi-hole blocks what its lists know. The audit inventories what was actually queried, adds dated training verdicts, and its findings often become your next blocklist entries.
The preview is free: 1 a day, 3 a month, 5,000 lines each. A full report is $99 once, which for the school was the term's entire audit budget. See pricing.
The dashboard shows top domains; the audit classifies them: which are AI, what risk, what training terms, dated. It answers the question the dashboard makes you guess at.
Pi-hole gives you three levers, and the report tells you which domains deserve which one.
Block-verdict domains from the report CSV go in as exact blacklist entries. Surgical, reversible, and visible in the next audit as attempts-only rows.
A tool with many regional subdomains gets one regex entry instead of a dozen exact ones. The report's hostname list shows you the pattern to write.
Lab machines get the strict policy, staff gets the moderate one. The audit's per-subnet reading tells you whether the split is working, per group, per term.
Networks with term rhythms should audit on term boundaries, not calendar months. The pattern that worked in the scenario:
Three previews a month means the term cadence fits entirely inside the free tier, with the paid report only where the paper trail needs it.
One SQLite query or one file download, then a free upload. The school found its findings in an afternoon; a homelab takes minutes.
Run the free audit