tv-watch

Keeps a running record of what the LG TVs ask DNS for, and whether it was blocked. At https://tv.jonathan.gluck.dev behind pocket-id.

A snapshot of a DNS log proves very little — a television phoning home twice is noise. The point is the shape over days: is telemetry climbing, is the set probing the LAN, and now that the firewall blocks its external DNS, does it start trying harder?

Sources

Pi-hole, every POLL_SECONDS. The recent query log is pulled and rows for the watched clients kept, de-duplicated on Pi-hole's own query id so re-polling is idempotent and history accumulates.

Pi-hole v6's /api/queries?client= parameter is silently ignored by the server — verified 2026-09-10, a bogus IP returns a full page. Filtering has to happen here. Do not trust that parameter.

UniFi, the hit counter on the Block LG TV external DNS policy. It only ever increases, so the page reports the rate: a rising slope means the TV is actively retrying, which is the interesting signal rather than the total.

Classification

telemetry — LG's own reporting endpoints (lgtviot.com, nextlgsdp.com, lgsmartad.com, …). lan-scan — *.in-addr.arpa, i.e. the TV resolving names for other devices on the network. Everything else is other.

Netflix and app telemetry are deliberately excluded. That follows from using Netflix, not from owning the television, and counting it would overstate the case.

First measurement (2026-09-10)

609 queries in the first poll from the living-room C1: 517 LAN reverse lookups, 42 telemetry, 50 other. The set spends most of its DNS traffic enumerating the house.

Related

• Pi-hole regex denylist: (\.|^)lgtviot\.com$, (\.|^)nextlgsdp\.com$
• UniFi policy Block LG TV external DNS — Internal→External, tcp_udp, ports 53 and 853, source the TVs' reserved IPs
• Neither covers DNS-over-HTTPS (port 443, indistinguishable from web traffic) or hardcoded IPs. The firewall hit rate on this page is the early warning.