3

Could anyone elaborate a little on this warning? Reading the unbound comment it references, I guess it's some configuration in place for security reasons (?), but I'm not clear on what the tradeoffs really are if you "get rid of" this warning by adding the config file mentioned below.

reducing DNS packet size for nameserver ADDRESS to SAFE_PKTSZ

When receiving answers from upstream only with a smaller maximum DNS packet size, dnsmasq warns about this and remembers this decision per server for some time (defaulting to 60 seconds).

If you see this message continuously, you are affected by some unusual truncation on the path from your Pi-hole to the configured upstream server. You can get rid of the warning by adding a config file like /etc/dnsmasq.d/99-edns.conf and adding

edns-packet-max=1232 After running pihole restartdns your Pi-hole will not even try larger packet sizes (the default is 4096). Check out our unbound guide for a comment about the particular value of 1232.

Improve this question

1 Answer 1

Reset to default
1

In the end it is just a warning. When you do not configure as suggested, pihole will continue using (and possibly requesting) larger packets. But the answering nameserver will always use the smaller packet size of 1232.

So there are some possibilities:

  • First, you have only a single upstream server your should reduce the packet size as suggested. Otherwise you will have the notification all the time. However, there will be not tradeoff in terms of performance.
  • Second, you have multiple upstream servers and some of them are affected an others are not. When reducing the size PiHole will ask all servers with the smaller size. The affected ones will reply anyways with the smaller size. But the non-affected once will be forced to use the smaller size, too. This means you will have a possibly performance degration as the server sends multiple smaller packets instead of a single larger one. But I guess this might be a not noticeable degration of performance.

Note: Above is a rough guess but I think it is accurate.

Improve this answer
1
  • Ok cool so I guess then the tradeoff is potentially a small perf hit. I know it's "just a warning" but I try to never ignore warnings - either address/fix the warning (if you understand what the fix does) OR at least try to understand the warning, since it must exist to tell you that something worse than "just a warning" is going on. Otherwise what's the point of warnings? :) But I think the details above help at least to understand it enough to try making the suggested change. Not sure I should mark as 'accepted' answer since there's still some uncertainty, but an upvote is fair I think!
    – Manius
    Commented Jan 27, 2023 at 17:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .