0

I'm using a raspberry with pi-hole and unbound (1.6.0) to manage my DNS.

Some days ago, I recognized that I have troubles with some domains but I didn't thought about DNS problems on my side. Today I looked deeper into this issue and interestingly I can debug this problem with the be TLD, tried it espacially with youtu.be and I can't get any record back from the be NS.

But when I'm trying to get the records via dig dig be. SOA +dnssec -p 5353, everything works great after that and I get records (A etc) back, also with status: NOERROR in dig. Very strange for me, have you any ideas about that? DNSSEC problems? I found in the unbound logs also some timeouts, but I'm not sure if this is a false positive or not.

Thats my main unbound config:

server:
logfile: "/var/log/unbound/unbound.log"
verbosity: 3
port: 5353
do-ip4: yes
do-udp: yes
do-tcp: yes
do-ip6: no
root-hints: "/var/lib/unbound/root.hints"
harden-glue: yes
harden-dnssec-stripped: yes
use-caps-for-id: no
edns-buffer-size: 1472
cache-min-ttl: 3600
cache-max-ttl: 86400
prefetch: yes
num-threads: 1
so-rcvbuf: 1m
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: 172.16.0.0/12
private-address: 10.0.0.0/8
private-address: fd00::/8
private-address: fe80::/10
hide-identity: yes
hide-version: yes

Log output when I'm trying to access youtu.be domain:

unbound[2552:0] debug: cache memory msg=67328 rrset=148220 infra=1335643 val=34997
unbound[2552:0] debug: iterator[module 1] operate: extstate:module_wait_reply event:module_event_noreply
unbound[2552:0] info: iterator operate: query be. DNSKEY IN
unbound[2552:0] info: processQueryTargets: be. DNSKEY IN
unbound[2552:0] info: sending query: be. DNSKEY IN
unbound[2552:0] debug: sending to target: <be.> 194.0.1.10#53
unbound[2552:0] debug: cache memory msg=67328 rrset=148220 infra=1335643 val=34997
unbound[2552:0] debug: cache memory msg=67328 rrset=148220 infra=1335643 val=34997
unbound[2552:0] debug: cache memory msg=67328 rrset=148220 infra=1335643 val=34997
unbound[2552:0] debug: iterator[module 1] operate: extstate:module_wait_reply event:module_event_noreply
unbound[2552:0] info: iterator operate: query be. DNSKEY IN
unbound[2552:0] info: processQueryTargets: be. DNSKEY IN
unbound[2552:0] info: sending query: be. DNSKEY IN
unbound[2552:0] debug: sending to target: <be.> 194.0.44.1#53
unbound[2552:0] debug: cache memory msg=67328 rrset=148220 infra=1335643 val=34997
unbound[2552:0] debug: cache memory msg=67328 rrset=148220 infra=1335643 val=34997
unbound[2552:0] debug: iterator[module 1] operate: extstate:module_wait_reply event:module_event_noreply
unbound[2552:0] info: iterator operate: query be. DNSKEY IN
unbound[2552:0] info: processQueryTargets: be. DNSKEY IN
unbound[2552:0] info: sending query: be. DNSKEY IN
unbound[2552:0] debug: sending to target: <be.> 120.29.253.8#53
unbound[2552:0] debug: cache memory msg=67328 rrset=148220 infra=1335643 val=34997
unbound[2552:0] debug: cache memory msg=67328 rrset=148220 infra=1335643 val=34997
unbound[2552:0] debug: iterator[module 1] operate: extstate:module_wait_reply event:module_event_noreply
unbound[2552:0] info: iterator operate: query be. DNSKEY IN
unbound[2552:0] info: processQueryTargets: be. DNSKEY IN
unbound[2552:0] info: sending query: be. DNSKEY IN
unbound[2552:0] debug: sending to target: <be.> 194.0.43.1#53
unbound[2552:0] debug: cache memory msg=67328 rrset=148220 infra=1335643 val=34997
unbound[2552:0] debug: iterator[module 1] operate: extstate:module_wait_reply event:module_event_noreply
unbound[2552:0] info: iterator operate: query be. DNSKEY IN
unbound[2552:0] info: processQueryTargets: be. DNSKEY IN
unbound[2552:0] info: sending query: be. DNSKEY IN
unbound[2552:0] debug: sending to target: <be.> 194.0.6.1#53
unbound[2552:0] debug: cache memory msg=67328 rrset=148220 infra=1335643 val=34997
unbound[2552:0] debug: iterator[module 1] operate: extstate:module_wait_reply event:module_event_noreply
unbound[2552:0] info: iterator operate: query be. DNSKEY IN
unbound[2552:0] info: processQueryTargets: be. DNSKEY IN
unbound[2552:0] info: sending query: be. DNSKEY IN
unbound[2552:0] debug: sending to target: <be.> 194.0.44.1#53
unbound[2552:0] debug: cache memory msg=67328 rrset=148220 infra=1335643 val=34997
unbound[2552:0] info: timeouts, concluded that connection to host drops EDNS packets 194.0.44.1 port 53
unbound[2552:0] debug: iterator[module 1] operate: extstate:module_wait_reply event:module_event_reply
unbound[2552:0] info: iterator operate: query be. DNSKEY IN
unbound[2552:0] info: response for be. DNSKEY IN
unbound[2552:0] info: reply from <be.> 194.0.44.1#53
unbound[2552:0] info: query response was ANSWER
unbound[2552:0] info: finishing processing for be. DNSKEY IN
unbound[2552:0] debug: validator[module 0] operate: extstate:module_wait_module event:module_event_moddone
unbound[2552:0] info: validator operate: query be. DNSKEY IN
unbound[2552:0] debug: rrset failed to verify due to a lack of signatures
unbound[2552:0] debug: rrset failed to verify due to a lack of signatures
unbound[2552:0] debug: Failed to match any usable DS to a DNSKEY.unbound[2552:0] debug: validator[module 0] operate: extstate:module_wait_subquery event:module_event_pass
unbound[2552:0] info: validator operate: query youtu.be. A IN
unbound[2552:0] debug: validator[module 0] operate: extstate:module_state_initial event:module_event_pass
unbound[2552:0] info: validator operate: query be. DNSKEY IN
unbound[2552:0] debug: iterator[module 1] operate: extstate:module_state_initial event:module_event_pass
unbound[2552:0] info: resolving be. DNSKEY IN
unbound[2552:0] info: resolving (init part 2):  be. DNSKEY IN
unbound[2552:0] info: resolving (init part 3):  be. DNSKEY IN
unbound[2552:0] info: processQueryTargets: be. DNSKEY IN
unbound[2552:0] info: sending query: be. DNSKEY IN
unbound[2552:0] debug: sending to target: <be.> 194.0.37.1#53
unbound[2552:0] debug: cache memory msg=67464 rrset=149492 infra=1335643 val=34997
unbound[2552:0] info: timeouts, concluded that connection to host drops EDNS packets 194.0.37.1 port 53
unbound[2552:0] debug: iterator[module 1] operate: extstate:module_wait_reply event:module_event_reply
unbound[2552:0] info: iterator operate: query be. DNSKEY IN
unbound[2552:0] info: response for be. DNSKEY IN
unbound[2552:0] info: reply from <be.> 194.0.37.1#53
unbound[2552:0] info: query response was DNSSEC LAME
unbound[2552:0] info: processQueryTargets: be. DNSKEY IN
unbound[2552:0] info: sending query: be. DNSKEY IN
unbound[2552:0] debug: sending to target: <be.> 120.29.253.8#53
unbound[2552:0] debug: cache memory msg=67464 rrset=149492 infra=1335643 val=34997
unbound[2552:0] info: timeouts, concluded that connection to host drops EDNS packets 120.29.253.8 port 53
unbound[2552:0] debug: iterator[module 1] operate: extstate:module_wait_reply event:module_event_reply
unbound[2552:0] info: iterator operate: query be. DNSKEY IN
unbound[2552:0] info: response for be. DNSKEY IN
unbound[2552:0] info: reply from <be.> 120.29.253.8#53
unbound[2552:0] info: query response was DNSSEC LAME
unbound[2552:0] info: processQueryTargets: be. DNSKEY IN
unbound[2552:0] info: sending query: be. DNSKEY IN
unbound[2552:0] debug: sending to target: <be.> 194.0.1.10#53
unbound[2552:0] debug: cache memory msg=67464 rrset=149492 infra=1335643 val=34997
unbound[2552:0] info: timeouts, concluded that connection to host drops EDNS packets 194.0.1.10 port 53
unbound[2552:0] debug: iterator[module 1] operate: extstate:module_wait_reply event:module_event_reply
unbound[2552:0] info: iterator operate: query be. DNSKEY IN
unbound[2552:0] info: response for be. DNSKEY IN
unbound[2552:0] info: reply from <be.> 194.0.1.10#53
unbound[2552:0] info: query response was DNSSEC LAME
unbound[2552:0] info: processQueryTargets: be. DNSKEY IN
unbound[2552:0] info: sending query: be. DNSKEY IN
unbound[2552:0] debug: sending to target: <be.> 194.0.43.1#53
unbound[2552:0] debug: cache memory msg=67464 rrset=149492 infra=1335643 val=34997
unbound[2552:0] info: timeouts, concluded that connection to host drops EDNS packets 194.0.43.1 port 53
unbound[2552:0] debug: iterator[module 1] operate: extstate:module_wait_reply event:module_event_reply
unbound[2552:0] info: iterator operate: query be. DNSKEY IN
unbound[2552:0] info: response for be. DNSKEY IN
unbound[2552:0] info: reply from <be.> 194.0.43.1#53
unbound[2552:0] info: query response was ANSWER
unbound[2552:0] info: finishing processing for be. DNSKEY IN
unbound[2552:0] debug: validator[module 0] operate: extstate:module_wait_module event:module_event_moddone
unbound[2552:0] info: validator operate: query be. DNSKEY IN
unbound[2552:0] debug: rrset failed to verify due to a lack of signatures
unbound[2552:0] debug: rrset failed to verify due to a lack of signatures
unbound[2552:0] debug: Failed to match any usable DS to a DNSKEY.unbound[2552:0] debug: validator[module 0] operate: extstate:module_wait_subquery event:module_event_pass
unbound[2552:0] info: validator operate: query youtu.be. A IN
unbound[2552:0] debug: validator[module 0] operate: extstate:module_state_initial event:module_event_pass
unbound[2552:0] info: validator operate: query be. DNSKEY IN
unbound[2552:0] debug: iterator[module 1] operate: extstate:module_state_initial event:module_event_pass
unbound[2552:0] info: resolving be. DNSKEY IN
unbound[2552:0] info: resolving (init part 2):  be. DNSKEY IN
unbound[2552:0] info: resolving (init part 3):  be. DNSKEY IN
unbound[2552:0] info: processQueryTargets: be. DNSKEY IN
unbound[2552:0] info: sending query: be. DNSKEY IN
unbound[2552:0] debug: sending to target: <be.> 194.0.6.1#53
unbound[2552:0] debug: cache memory msg=67464 rrset=149492 infra=1335643 val=34997
...
  • Let me get this straight, it does not work as long you use port 53, that is it? At home or corporate? Any firewall? Allowing UDP/53 AND TCP/53? – Rui F Ribeiro Apr 17 at 10:18
  • Hi Rui, not exactly. It's not working as long as I'm manually triggering the DNS query with the digcommand above. My Unbound is running on port 5353, my "front" dns server is running by pi-hole on port 53. But is has nothing to do with the pihole, because the dns query is not working on the 5353 unbound DNS server. This setup is running at home, no outbound firewall, only inbound firewall, so yes, Port 53 outbound is allowed. This setup was running for half an year very smooth, just jet I got the problems but haven't touched anything on unbound. – The0 Apr 17 at 12:24
  • "connection to host drops EDNS packets" this is not good, and at least will trigger timeouts or worse. Look at dnsflagday.net/#resolver-ops – Patrick Mevzek Apr 17 at 23:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.