Finicky DNS - Resolver

maverik1

I have recently switched over to DNS Resolver from DNS Forwarder. Current settings are:

Port: 53
Network Interfaces: All (I have Vlans)
Outgoing Interfaces: All
Local Zone type: Transparent
DNSSEC: disabled, will not work with OpenDNS
DNS Query Forwarding: Enabled (I am wanting to forward to OpenDNS, these servers are set in General Setup)
DHCP Registration:enabled
Static DHCP:enabled

I have added host overrides for various network devices.

Under advanced everything is default. I did disabled DNSKEY support and Harden DNSSEC Data

I am currently on a Test vlan with one firewall rule to any any. The problem is I am having weird issues with DNS, sometimes my queries have timeouts or take awhile to resolve. A few examples below of nslookup.

Nslookup to outside domain:

C:\Users\Me>nslookup foxnews.com
Server: admin.syndicate.com
Address: 10.0.0.1

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
Non-authoritative answer:
Name: foxnews.com
Address: 104.68.123.149

Nslookup to local host. This host has been added in host overrides.

C:\Users\Me>nslookup guest.syndicate.com
Server: admin.syndicate.com
Address: 10.0.0.1

DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
Name: guest.syndicate.com
Address: 10.0.3.1

This comes back quicker:

C:\Users\Me>nslookup 10.0.3.1
Server: admin.syndicate.com
Address: 10.0.0.1

Name: guest.syndicate.com
Address: 10.0.3.1

Per the main page, DNS servers are as follows:

127.0.0.1
208.67.222.222
208.67.220.220

Sometimes the queries time out all together and sometimes they are just slow to resolve. Is this just a limitation of the resolver?

Thanks for any input.

awebster

Take a look at your windows DNS servers configuration, maybe there is something in there that doesn't belong.

maverik1

The only DNS servers in the Windows host is from the firewall itself. I do not have the delay or timeout when doing the nslookup from the console or the gui. Might just be a windows thing, I do not know. Looking at /etc/resolv.conf, I see the following:

nameserver 127.0.0.1
search syndicate.com (this is my domain)
208.67.222.222
208.67.220.220

Which is what it should show.

awebster

On windows, do this:

nslookup
set debug
set d2
set type=a
foxnews.com

There will be quite alot of output, but you will see exactly what questions are being asked and to whom, and what responses you are getting.
I should point out, that DNS works by initially appending the local host's domain name to the query, so the very first query will be foxnews.com.syndicate.com, which should result in an immediate not found error, but DNS will then try again with foxnews.com.
It is possible that this "error" condition is what's causing the issue.

You can also try foxnews.com. (notice the trailing dot) to have it not append your domain name. If you get fast results, then the problem is with your config on pfsense, as it isn't returning a negative answer immediately.

maverik1

Yeah, that makes sense now. Windows is appending the DNS suffix search list on all look ups. In my case, it is syndicate.com. I have corrected it by editing the DNS settings on the network card to Append DNS suffixes in order, starting with "." and then "syndicate.com" No issues now. Much Thanks