Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times

    Scheduled Pinned Locked Moved DHCP and DNS
    176 Posts 6 Posters 22.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @RickyBaker
      last edited by

      @RickyBaker said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:

      All of this leaves me a little lost as to next steps.

      The next step is to wait till you fail again.. You were seeing servfail - but we didn't know why or what was the reason for it. Now that you have enabled logging of servfail details.. Next time you have a problem - we can hope to see why.. And then address that..

      Also have you updated to 2.7.2 yet? This should be your next step to be honest..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      R 2 Replies Last reply Reply Quote 0
      • R
        RickyBaker @johnpoz
        last edited by

        @johnpoz said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:

        Also have you updated to 2.7.2 yet? This should be your next step to be honest..

        no i have not but I can prioritize. i know it SHOULD be easy and smooth but i'm so nervous. especially with it not updating by itself.

        @SteveITS said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:

        https://bluecatnetworks.com/blog/the-top-four-dns-response-codes-and-what-they-mean/

        thanks this is a very useful article

        1 Reply Last reply Reply Quote 0
        • R
          RickyBaker @johnpoz
          last edited by

          @johnpoz said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:

          The next step is to wait till you fail again..

          and what specific commands should i be running? I assume you don't need the resolvectl one, just "dig www.netgate.com" or www.msn.com?

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @RickyBaker
            last edited by

            @RickyBaker yeah and looking in the log.. So we can see what it logs for failure if the dig output doesn't show us as much detail on it, etc.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            R 2 Replies Last reply Reply Quote 0
            • R
              RickyBaker @johnpoz
              last edited by

              @johnpoz said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:

              yeah and looking in the log.. So we can see what it logs for failure if the dig output doesn't show us as much detail on it, etc.

              great thanks for the clarification

              R 1 Reply Last reply Reply Quote 0
              • R
                RickyBaker @RickyBaker
                last edited by

                @RickyBaker spent all afternoon waiting with my computer for an outage, finally went to bed around 1130pm. Happened right away and resolved by the time i sprinted downstairs. stay tuned

                R 1 Reply Last reply Reply Quote 0
                • R
                  RickyBaker @RickyBaker
                  last edited by

                  been hunting non-stop but the network has "unfortunately" been very stable this week. This morning my wife said she was experienceng the DNS NX issue on her phone right when we woke up but when i fired up my phone I wasn't experiencing the problem. Went about my morning and a few minutes later, while on the head without a laptop, it happened to me. I fired up my ssh app and ssh'ed into the plex server and got this:
                  4ae8f116-5d79-4326-88ba-7db61ae9dde9-image.png

                  ...but then i realized i was doing it on another machine that may not be experiencing the problem. I don't know why I didn't put that together before but the DNS issue USUALLY affects all devices at once but obviously not always. unfortunately my phone's local ssh session doesn't have the dig command. I'll look at installing it to increase my chance of catching it. Unfortunately I forgot that i only have a few minutes to screenshot the logs before they roll off and I missed it. I'm optimistic i'll catch it this weekend.

                  R 1 Reply Last reply Reply Quote 0
                  • R
                    RickyBaker @RickyBaker
                    last edited by

                    @RickyBaker Still hunting, frustratingly the problem has def gotten less frequent an shorter in duration (but still ever present, my wife agrees, i'm not crazy). It's also happening more on individual devices where other devices work fine more often than before. It happened on my PC and when I ran the dig command on my plex debian box it was fine
                    35945eaa-e74d-4f92-a6fe-97ab9e08ff50-image.png
                    In the log though I did find this around when I tried the dig command:
                    64ca1ece-7294-49d1-9de5-c7c5e52f0999-image.png
                    I also found this which looks shady to me:
                    2cc00f36-7728-4eb0-b544-b9ecb6cae6c1-image.png

                    Since it seems to be singular devices at a time now i'm slowing figuring out how to run dig commands on all the different OS's in my house. I have Android and linux and am following a tutorial for Windows now...

                    R 2 Replies Last reply Reply Quote 0
                    • R
                      RickyBaker @RickyBaker
                      last edited by

                      @RickyBaker said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:

                      following a tutorial for Windows now...
                      So i was trying to follow this tutorial but when I went to install it said it was already installed (I used the legacy windows version). I had tried to install it before but then typing the dig command still returned a "command not found". The installer suggested i remove the old one from add/remove programs but I couldn't find anything under BIND or ISC and the last installed program was discord a LONG time ago.
                      d2c25974-fd05-49ac-8c2d-cdc30f4ad623-image.png

                      I tried to continue with the tutorial but it asked where BIND was installed to add it to the PATH (which I'm sure was my problem the first time around) but I don't know where it's installed and a windows search for BIND or ISC is expectedly noisy. any suggestions?

                      I'll keep plugging at it but it's an annoying speed bump that's really slowing down the troublshooting...

                      1 Reply Last reply Reply Quote 0
                      • R
                        RickyBaker @RickyBaker
                        last edited by

                        Finally got one!!!
                        a11f2b0d-4e85-4142-a359-69d7e0f7f15c-image.png
                        I pasted everything in the log back a few minutes here in case the totality of it is useful

                        https://pastebin.com/w2SGh8P0

                        d69e124e-ae98-4210-ac36-e018efc38964-image.png

                        @johnpoz Sorry for the delay in getting this I swear i was trying the whole time. thanks for the patience.

                        1 Reply Last reply Reply Quote 0
                        • S SteveITS referenced this topic on
                        • T The Party of Hell No referenced this topic on
                        • R
                          RickyBaker @johnpoz
                          last edited by

                          @johnpoz got another one! though it does seem to be happening with a lot less frequency for some reason, i've just gotten better at catching them during the quick window of opportunity:

                          https://pastebin.com/WjyAukgm

                          a961d400-b54b-4b2b-98bf-e2b48d4f5c1c-image.png

                          4331c59c-e8ce-4017-b1c1-18b9bce53af8-image.png

                          1 Reply Last reply Reply Quote 0
                          • R
                            RickyBaker
                            last edited by

                            This one got a NXDOMAIN error:

                            b0fd4629-6122-4e55-9564-a02f4bcc6cd1-image.png

                            cb230e77-8fdb-4c0b-ab79-9e21fd940514-image.png

                            S GertjanG 2 Replies Last reply Reply Quote 0
                            • S
                              SteveITS Galactic Empire @RickyBaker
                              last edited by

                              @RickyBaker said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:

                              This one got a NXDOMAIN error:

                              That is a URL not a hostname so it should fail. Remove the /apps/staff (as shown in the prior post).

                              Searching for "exceeded the maximum number of sends" looks like DNSSEC...:
                              https://community.ipfire.org/t/servfail-exceeded-the-maximum-number-of-sends/7645
                              https://www.reddit.com/r/pihole/comments/11hqrco/intermittent_servfail_when_using_unbound/

                              this one talks about not using UDP for DNS...?!
                              https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=270824

                              This one talks about torrenting and DNSSEC:
                              https://www.reddit.com/r/opnsense/comments/1cinuyn/unbound_dns_issues_freezes_randomly/

                              Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                              When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                              Upvote 👍 helpful posts!

                              R 3 Replies Last reply Reply Quote 1
                              • GertjanG
                                Gertjan @RickyBaker
                                last edited by Gertjan

                                @RickyBaker

                                About :

                                43420012-bae2-4e47-93a8-c1efbc5bebbe-image.png

                                This very issue (or whatever it is) has its own thread on NLnetLabs (the author of unbound) exceeded the maximum nameserver nxdomains.
                                One of the authors of unbound is also answering.
                                Some tips are present.

                                Btw : this is DNS at its finest. I'll take this one home tonight, need to read it again.

                                Latest posts in that thread are just hours ago.

                                Here you go :

                                server:
                                	qname-minimisation: no
                                	aggressive-nsec: no
                                
                                	infra-keep-probing: yes
                                	infra-cache-max-rtt: 2000
                                	infra-host-ttl: 0
                                
                                	outbound-msg-retry: 32
                                	max-sent-count: 128
                                

                                dono what the impact will be ....
                                I've never seen this "exceeded the maximum nameserver nxdomains" message myself.

                                No "help me" PM's please. Use the forum, the community will thank you.
                                Edit : and where are the logs ??

                                R 1 Reply Last reply Reply Quote 1
                                • R
                                  RickyBaker @Gertjan
                                  last edited by

                                  @Gertjan said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:

                                  Here you go :

                                  is the suggestion to throw this into the custom options section of the dns resolver? I'll check out all the links, was just looking to confirm the suggestion you had forwarded on...

                                  GertjanG 1 Reply Last reply Reply Quote 0
                                  • GertjanG
                                    Gertjan @RickyBaker
                                    last edited by

                                    @RickyBaker

                                    Exact.
                                    Like this :
                                    fa273201-a380-4dd7-bf29-9c12dabb6f6f-image.png

                                    No "help me" PM's please. Use the forum, the community will thank you.
                                    Edit : and where are the logs ??

                                    R 2 Replies Last reply Reply Quote 1
                                    • R
                                      RickyBaker @Gertjan
                                      last edited by

                                      @Gertjan awesome, thanks for clarification. It's been added. I'll read up on all these threads while I wait for it to fail...

                                      S 1 Reply Last reply Reply Quote 0
                                      • S
                                        SteveITS Galactic Empire @RickyBaker
                                        last edited by

                                        Just to link that other thread, which two of us linked above, to this one:
                                        https://forum.netgate.com/topic/188297/sporadic-dns-issues-cryptic-error-in-logs/

                                        Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                        When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                        Upvote 👍 helpful posts!

                                        1 Reply Last reply Reply Quote 1
                                        • R
                                          RickyBaker @SteveITS
                                          last edited by

                                          @SteveITS said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:

                                          this one talks about not using UDP for DNS...?!
                                          https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=270824

                                          reading through these now, this one caught my eye because one of the only packages i have installed is UDP Broadcast Relay (in order to forward across the VLAN's I set up). Though i'll be honest, I really don't know much about UDP/TCP and not sure if this is the same ballpark as the Broadcast Relay. I can try the tcp-upstream: yes option after I feel confident the last iteration of changes didn't solve the issue.

                                          1 Reply Last reply Reply Quote 0
                                          • R
                                            RickyBaker @SteveITS
                                            last edited by

                                            @SteveITS said in DNS_PROBE_FINISHED_NXDOMAIN sporadically for anywhere from 30secs to 10min. works flawlessly at all other times:

                                            https://www.reddit.com/r/opnsense/comments/1cinuyn/unbound_dns_issues_freezes_randomly/

                                            This is another interesting theory, but I searched my log and I don't see anything referencing a tracker. Though I did just notice my enphase solar controller also just got a bunch of servfails...

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.