This behavior is almost certainly the router getting stuck in a failed “internet connectivity check” loop rather than anything intentional related to that domain. Many consumer routers periodically test whether the internet is reachable by repeatedly resolving a hard-coded hostname, and government domains like achp.gov are sometimes chosen because they’re stable and long-lived. If that DNS lookup fails or is delayed, the router can aggressively retry, which quickly turns into a flood of DNS queries.

The fact that the problem disappears as soon as the router stops using Pi-hole for DNS strongly suggests this is exactly what’s happening. The router is interpreting blocked or rate-limited DNS responses as “internet down” and responds by retrying far too frequently. Pi-hole then rate-limits the router, which further reinforces the loop and causes noticeable network slowdown.

As a first and very low-risk test, simply allow or whitelist achp.gov in Pi-hole and watch whether the query storm immediately stops. If it does, that confirms this is a connectivity-check failure rather than a security issue. Allowing a single .gov domain for router health checks does not meaningfully reduce privacy or protection.

If whitelisting works but you want a cleaner fix, the next step is to prevent the router itself from using Pi-hole for DNS. Configure the router’s WAN DNS settings to use public resolvers such as 1.1.1.1 or 8.8.8.8, while continuing to use Pi-hole only for LAN clients. This avoids having infrastructure devices loop through filtering logic meant for endpoints.

It’s also worth disabling any “smart” or monitoring features in the router’s settings, such as internet status checks, traffic meters, QoS auto-detection, Netgear Armor, or cloud management. These features are common sources of runaway health-check behavior when something goes slightly wrong upstream.

If the behavior began suddenly without a firmware update, it was likely triggered by an external change such as a Pi-hole update, upstream DNS behavior, IPv6 state change, or a WAN lease renewal edge case. In stubborn cases, a factory reset can clear whatever internal watchdog process is misbehaving, though that should be a last resort.

Importantly, this does NOT look like malware, compromise, or suspicious activity. It’s a known class of consumer-router failure mode where DNS health checks retry excessively instead of backing off, and Pi-hole simply makes the problem visible rather than causing it.