@richpriest what I wound up doing was putting a second pihole on a second rpi, and having that connected to the guest network. So everyone on my guest network tries the primary DNS but can't get to...

I agree with all of the above that this feature is lacking. Only workaround I can think of currently (for the pi-hole use case) is to set up a whole separate dns server on the guest network and then...