Just an fyi, it's good to setup firewall redirection from suspicious devices as well.

For my Roku I have setup a redirection for all DNS port queries to my pihole as some app developers are getting wise to this and using their own DNS.

It won't be long until they encrypt this traffic and lock us out completely though.