DNS & ISP

Your Pi-hole DoH Guide Is Broken Now

If you followed the standard Pi-hole tutorial to add encrypted DNS with cloudflared, it quietly stopped working. Cloudflare removed the feature it depended on. Here's what happened and what to do instead.

What Actually Changed

Starting February 2, 2026, Cloudflare removed the proxy-dns command from new cloudflared releases. It was an undocumented feature that ran a small client-side DNS-over-HTTPS proxy, and Cloudflare pulled it after a vulnerability turned up in an underlying DNS library. Cloudflare Tunnel and cloudflared's other features are unaffected, this was specific to that one command.

Why This Broke Pi-hole Specifically

For years, the official Pi-hole documentation told you to install cloudflared as a background service listening on a local port, then point Pi-hole's upstream DNS at that address so queries left your network encrypted. That guide only works because of proxy-dns. Once cloudflared updates past the cutoff, the command errors out instead of starting, and Pi-hole's upstream quietly stops resolving over HTTPS.

Signs Your Setup Is Affected

The cloudflared service fails to start or restart-loops after an update.
Logs show something like dns-proxy feature is not supported.
Pi-hole's upstream shows resolution failures, or devices on the network suddenly can't reach sites.
Setups that haven't updated cloudflared since before the cutoff may still be running, on a clock, existing installs keep working for a while but the next update breaks them.

Three Ways to Actually Fix It

Cloudflare's official pathFor a router or server sitting in front of multiple devices, Cloudflare's own recommendation is now WARP Connector instead of proxy-dns.

Swap the sidecarPoint Pi-hole's upstream at a different local DoH/DoT proxy, like dnscrypt-proxy, in place of cloudflared. Same pattern, different binary, and it isn't on Cloudflare's deprecation clock.

Skip the proxy entirelyRun Unbound locally with DNS-over-TLS to your upstream so there's no separate client-side proxy to install, update, or babysit. See our Unbound guide for how that setup works.

Common Questions

Is my Pi-hole itself broken?

No. Pi-hole is fine. It's the cloudflared DoH sidecar most tutorials had you bolt on next to it that broke.

Do I need to fix this right now?

If cloudflared hasn't updated past the cutoff on your box yet, you have a grace window, existing installs keep running for a while. But any future update breaks it, so fix it before your next update rather than after.

Does Harbor Privacy use cloudflared?

No. Harbor resolves through Unbound directly, so this deprecation doesn't touch it.

WANT TO STOP MAINTAINING THIS YOURSELF?

Harbor Privacy resolves DNS through Unbound directly to the root servers, no client-side proxy binary to install, update, or watch break when a vendor changes course. See how it works.