DNS Resolver unable to answer queries ro .tv tld

Schirrms

Hi everybody,

New on this forum, but "not so new" user of pfsense, I ran today on an odd problem :
My PFSense server is the home firewall, with DNS resolver setup. PFsense is on the latest version available 2.6.0 (community edition). I don't remember putting strange settings (but I cannot guarantee :) )
Today, any resolution on any domain from the tld .tv gave a timeout.
I don't use my ISP DNS forwarders, the two forwarder configured are Google's 8.8.8.8 and 8.8.4.4.
Obviously, those two DNS are able to resolve entries from the tv tld.
I tried to clear the cacher, restart the DNS, without success.
Finally, I put in the domain override section

tv. --> 8.8.8.8

and the DNS clients are happy. But this is probably not a solution.

Any hints ?

Thanks,

Pascal

johnpoz

@schirrms dig you actually setup forwarding - just putting some dns in the general setting, doesn't have unbound use them. You have to actually click forwarding in the unbound settings.

Also if your going to forward, its a good idea to uncheck use dnssec - if you forward, where you forward does dnssec or it doesn't - having that check does nothing but extra queries that could cause issues.

If you can not resolve anything in the .tv domain - this points to a problem in talking to any of the NS that are authoritative for .tv - you could do a dig +trace on your pfsense to validate that.

Setting domain override for tv. working pretty much proves that your not forwarding in the first place.. But that setting tells unbound hey do not resolve this on your own, forward that domain.

Schirrms

Hi @johnpoz, thank you for your answer :)

@schirrms dig you actually setup forwarding - just putting some dns in the general setting, doesn't have unbound use them. You have to actually click forwarding in the unbound settings.

Just to be totally sure, in the DNS resolver configuration, General Setting Tab, the checkbox 'Enable Forwarding Mode' is checked. This is 'the' setting ?

Also if your going to forward, its a good idea to uncheck use dnssec
OK, this was checked, I'll uncheck it and test again.

Two minutes later : Yes, that did the trick ! unchecking the DNSSEC did resolve the issue !

Many thanks !

Should I do more investigation, or is this solution a correct solution ?

Thanks,

Pascal

johnpoz

@schirrms when you forward, the dns you forward to either does dnssec or it doesn't that setting can cause issues if your asking unbound to do dnssec, but its not actually resolving.

That setting when you click forward should in my opinion be auto unchecked, there is really no scenario where you would forward and also want unbound to try and do dnssec..

Where you forward either already does it or it doesn't - that setting is only going to cause extra queries and most likely issues.

If you want to use dnssec when you forward, pick a server to forward to that does it - which is most of them. If you don't want to do it - then pick one that doesn't. Many of the big providers have a different IP to use that doesn't do it.

For example quad9 has 9.9.9.10 that doesn't do dnssec

9.9.9.10 Provides: No security blocklist, no DNSSEC, No EDNS Client-Subnet sent. Please use the unsecured secondary address of 149.112.112.10

Having unbound do dnssec only makes sense when its resolving stuff on its own.