I did have backups, it was an easy fix. I had a pihole -up on a crontab for years, probably not the best idea :)

FW rule accept :53 from pihole only, deny :53 from all. I had some devices with hardcored DNS settings (8.8.8.8).