Pi-hole is a DNS sinkhole you run yourself, usually on a small computer on the home network. Devices use it as their resolver. Domains on your block lists get a dummy answer, so the ad or tracker never loads. The admin page shows which device tried to call which name.
Pi-hole does not encrypt anything by itself. If you leave the upstream as your provider’s plain DNS, you built a nicer dashboard for the same postcard. Point it at Quad9 or another encrypted resolver, or run Unbound and accept the extra work. You also own the updates, the power cord, and the day the SD card dies. Phones that leave the house ignore the Pi-hole unless you add a VPN back home.
Use it for the whole flat, TVs included. Do not call it encrypted DNS until the upstream is. pi-hole.net
Give the Pi-hole a static address on the router and tell the router to hand that address out as DNS. Clients that let you set DNS manually should still be pointed at it, or they will ignore the router. Use an encrypted upstream. Export the config when you like the lists. The SD card will fail. A Pi-hole with no exported settings is a weekend you will repeat.
