> Could you explain this a little further - is the Pihole also running on the Synology?
Yes
> Or is secondary DNS the Synology?
To be precise,
In LAN, the Synology NAS is the primary DNS (running PiHole on Docker), and the router the secondary. This is to reduce the load on the router. They're both using Quad9's servers on port 853 and using DNSSEC.
In WAN, which is only possible via WireGuard, the router is also the primary and only DNS. This is because I don't think it makes sense to add redundancy and additional latency here. If I'd need additional redundancy here, I'd also need an additional endpoint.
All outgoing DNS traffic going to port 53 (such as Google's) gets not coming from the Synology NAS gets forwarded to the router. Which is very little in my use case.
Could you explain this a little further - is the Pihole also running on the Synology? Or is secondary DNS the Synology?