Big DNS Problems *Illustrated*
-
Where are you overriding it to go? I don't use tidal - to honest not sure what plex is trying to do there at all..
Maybe chrome is doing its own sort of rebind protection? Best thing to do is sniff to see exactly what the client is asking for and what is or isn't getting returned, etc.
Can tell you for sure with out turning off rebind for plex.direct your going to run into issues - and prob only get indirect connections to your local plex box.
-
@johnpoz I'm overriding it to go to one of Plex's servers still (one of their secondary servers)... just saving Unbound a couple of resolution steps. I was running into timeout issues occasionally. I don't use TIDAL, so no idea what might be going on with that.
-
So your overriding it to go direct to the authoritative ns for plex? Yeah that would turn off dnssec and rebind..
Once the domain is resolved once - the authoritatives would be cached for the life of the ttl, and would not have to resolve any more? Would just have to ask the cached NS for the domain direct, if a record TTL had expired.
If your having timeouts on resolving - try turning on prefetch, and even the serve 0 ttl option.. This can help if you have slow resolving for specific domains.
-
Already had prefetch on... will turn on Serve 0 TTL also.
Again, apologies to the OP for the slight tangent... what turned out to be me trying to point something out has instead helped me... hopefully your issue can be resolved too, though not sure what has been given to me is at all related to your problem.
-
So just looked and the TTL on those ns for plex.direct are quite long
example
;; ANSWER SECTION: ns-plexdirect.plex.tv. 604800 IN A 82.94.168.7Is your unbound restarting a lot @virgiliomi -- once that is looked up once, you should not have to resolve the NS for plex.direct again for quite some time.. 7 Days to be exact ;)
-
@johnpoz Are you talking to me John? I do not really understand your message.
Do you have any idea what my problem might be caused from?BTW, private-domain: "plex.direct" fixed "Unable to connect to "HDPlex" securely.".
-
@johnpoz Gonna PM you and we can continue chatting there so the topic can go back to the OP's issue.
-
Yeah sorry @skalyx me and @virgiliomi kind of got on a bit of tangent there from your problem.
So putting in plex.direct back into custom fixed your plex problem - but your still having issues with tidal? I guess I do the free trial thing and see if could duplicate your problem.
-
@johnpoz
No worries!
For the moment, TIDAL is working fine haha. Problems happen from time to time not constantly so I will have to see over time. -
UPDATE: I got the problem again with known website such as cloudflare.com etc. I will try to remove plex entry again in custom option (DNS Resolver).
Do you have any idea to help me out?
-
that plex.direct would have zero to do with resolving something on cloudflare unless your are maybe using it as reverse proxy for your plex? And even then it should not be a problem.
-
Yeah, this seems much more likely to be a DNS resolution issue. I would try running the resolver directly in resolving mode if you are going to have DNSSec enabled and see if the issue repeats.
Steve
-
@johnpoz Yes, it is logical. I do not use reverse proxy.
@stephenw10 Hmm. Could you please let me know how I can run the DNS resolver directly in resolving mode?
Thanks,
-
Resolving mode is the default setting. If you are using Cloudflare's DNS server though you would have to have set Unbound to forwarding mode. If you use that everything that request is forwarded to must support DNSSec otherwise results will be rejected.
Simply unchecking 'use forwarding mode' in Sevices > DNS Resolver will put it back to resolving directly.
Steve
-
If your going to "forward" then having dnssec enabled is utterly just a waste of resources..
If you forward to a dnssec resolver - then its being done for you already... If you ask for a dnssec to something that doesn't support it, be it yet another forwarder or even a resolver it really means nothing..
If you forward enabling dnssec on your forwarder is just pointless plain and simple.
If you want to use dnssec, then you either resolve directly like unbound does out of the box, or you forward to a resolver that is doing it for you like cloudflare.
-
@stephenw10 Thanks. But if I set as Unbound, I won't get DNSSEC anymore or will I?
My problem is not constantly with one domain. Actually, it happens time by time.
For instance, I am normally able to access YouTube.com or any other website. However, a time comes where I cannot say access these websites. I think my DNS Resolver crashes because when I restart it or wait for about 5-15 minutes everything works. When this situation happens, I can ping 8.8.8.8 or any other address so it really is a DNS issue.
That's really weird... I changed my hardware as well... -
And are you using pfblocker, it can really delay the start of unbound.. So if your unbound is restarting all the time say on dhcp lease registration, or pfblockers own cron job that runs every hour for example.. And your unbound is taking long to start then yeah you can run into stuff like what your talking about where stuff doesn't resolve and then all of sudden does.
You could also just have delays in resolving depending if your on a high latency line, or the authoritative ns you are asking info from is on the other side of the planet from you, or is just slow or your connection via peering to that network on via your isp is bad.
If your having trouble with specific domains resolving - then you need to troubleshoot the particulars of that problem.. Dig +trace can be your friend in troubleshooting specific domains lookup problems.
But if your going to forward to NS xyz, turning on dnssec in unbound is just pointless. Cloudflare already does dnssec - so you have zero reason to have it enabled in unbound.. You will get it if you want it or not if forwarding to their dnssec enabled IP.. They have other IPs you can use if you do not want dnssec.
-
@johnpoz said in Big DNS Problems *Illustrated*:
If you want to use dnssec, then you either resolve directly like unbound does out of the box, or you forward to a resolver that is doing it for you like cloudflare.
Thanks, John! So... You recommend me to let the forwarding mode in DNS Resolver and deactivate DNSSEC support? How can I activate unbound DNSSEC?
-
If your going to "resolve" with unbound and not forward then out of the box it would be doing dnssec.. You would have to on purpose uncheck the dnssec box if you didn't want unbound to be doing dnssec.
If your going to "forward" with unbound then yes you should uncheck the dnssec box - because it makes no sense to ask for dnssec info from where your forwarding.. It will not be actually validated, and is just waste of time.. The forwarder could send you back whatever it wants to be honest..
If you forward to a resolver like cloudflare that is doing dnssec, then no reason to ask it for anything - since its already doing it anyway be it you ask for it or not.
-
@johnpoz
I see. I think my network is quite good and my ISP as well. I think the problem is on my side configuration-wise... I am still looking... Also, when the problems come, the DNS issues are with all domains not only one.
So what about doing what Stephen recommend me which is:
"Simply unchecking 'use forwarding mode' in Sevices > DNS Resolver will put it back to resolving directly." and letting DNSSec support?
