How do you deal with https traffic? Wouldn't you need to MITM proxy everything and install CA certs on the client? And wouldn't that reduce client side security since all certs would be signed by the same CA?
https://docs.pi-hole.net/ftldns/blockingmode/
For hosts files, 0.0.0.0 is generally preferred, which marks the host as unreachable, rather than localhost (127.0.0.1, etc.), which might well recieve and try to process the request.
I'm using the defaults, but from the sounds of the documentation having it return 0.0.0.0 might be beneficial. It certainly explains some weirdness that I've seen when using Pi-Hole.
Thanks!