Set up DNS for a new subdomain. Worked for everyone. Didn't work for me.

dig @1.1.1.1 newdomain.example → returned the records. dig newdomain.example (via Pi-hole) → NXDOMAIN.

Pi-hole had cached an NXDOMAIN response from when the record didn't exist yet, and was confidently serving the stale "no" for ~30 minutes per the SOA's negative-cache TTL. Even though it forwards to Cloudflare, it doesn't re-ask every time.

pihole restartdns

Two seconds. Cache cleared. The domain "exists" again.

The wider point: when a domain looks broken on your home network but works elsewhere, suspect your own resolver before suspecting the upstream. And remember that "the resolver says OK" isn't the same as "the answer it's giving you is current."