Would you mind to (quickly) explain how the feature "Captive portal with DNS blackhole to capture wifi passwords" works?
Does it expect the "victim" to input the WPA password into a fake web page?