Big DNS Problems *Illustrated*

johnpoz

simple dig command for the domains your trying to access, nslookup even.

You understand that NX domains, means what you were locking for doesn't exisit..

It is impossible to troubleshoot with such info... You have to give us the actual domain you were trying to go too.. Let us see an actual output of the lookup.

$ dig www.google.com                                                      
                                                                          
; <<>> DiG 9.14.1 <<>> www.google.com                                     
;; global options: +cmd                                                   
;; Got answer:                                                            
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3890                  
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1      
                                                                          
;; OPT PSEUDOSECTION:                                                     
; EDNS: version: 0, flags:; udp: 4096                                     
;; QUESTION SECTION:                                                      
;www.google.com.                        IN      A                         
                                                                          
;; ANSWER SECTION:                                                        
www.google.com.         2824    IN      A       172.217.4.196             
                                                                          
;; Query time: 1 msec                                                     
;; SERVER: 192.168.3.10#53(192.168.3.10)                                  
;; WHEN: Tue May 28 05:30:25 Central Daylight Time 2019                   
;; MSG SIZE  rcvd: 59

skalyx

@johnpoz Hello, thanks for the reply.
I actually get these DNS error messages for a while but then it reloads and works! So I can access the website after the error message but it takes about 8 seconds. This is the case with any domain (cloudflare.com, youtube.com, reddit.com, netgate.com, etc.). It sometimes happens (like every 30min) and then everything gets back to normal. I cannot see anything in my log but I will reply to the post whenever the problem happens again with detailed logs.

stephenw10

Bring on encrypted SNI!

skalyx

@stephenw10 sorry Steve. I do not know what you are talking about hahaha

johnpoz

Its an up and coming protocol so that as you saw in my posted client hello you could easy see the fqdn connecting too.. With encrypted sni, you will not be able to do that ;)

https://blog.cloudflare.com/encrypted-sni/

To be honest only and when that is actually common does it make any sense to try and hide dns. Until then - hiding your dns is more like when small child closes their eyes and think you can not see them ;)

There are many so called security practice that do really nothing but give the user of said practices a "false" sense of security ;)

skalyx

@johnpoz I see, John. Thanks for the explanation.

Do you have any idea about what I could do to fix my issue?

Thanks,

johnpoz

@skalyx said in Big DNS Problems *Illustrated*:

Do you have any idea about what I could do to fix my issue?

Not without you providing some actual useful info..

Lets see a dig query to pfsense when you say you have problem resolving suff. Did you bump logging in unbound, did you set it to actually log queries and answers? This can be done in the options box.

Have you looked to see what unbound shows for where it would lookup domainx.tld that your having problems with..

This will show you the stats for unbound talking to a specific NS that it uses to query for domainx.tld, etc.

If you don't want to try and troubleshoot the actual problem, then use forwarding mode, or use dnsmasq on pfsense (forwarder) vs unbound. Or have your clients point directly to some outside dns, etc. One slick thing with dnsmasq as forwarder vs unbound as one - is dnsmasq can ask multiple dns at the same time and use the fastest response.. So you could have say 4 different NS listed from 4 different dns services and it would ask all of them - and use the one that responds first.

You say your on some "amazing" 4G connection.. Ok sure - what are the response times? What does the quality graph on pfsense show for this connection... Maybe its not as "amazing" as you think... As mentioned already high latency lines are not going to be good option for resolving.

skalyx

@johnpoz
Thanks for the answer and sorry for the late reply. I got some personal issues.

Yes, I looked at the logs and I could not see anything weird with my knowledge. I, then, activated forwarding mode without DHCP lease last morning and from that time I do not see any problem. Very weird. Maybe DHCP lease was what caused problems to me. My internet experience is much faster even with DNS over TLS enabled. No DNS problems so far. I will, however, look into Dnsmasq. It really looks amazing.

My DNS responses time based on DIG results look kind of similar to my neighbors VDSL connection. He gets better responses time but pays 15 times more than me. Regarding my ping, I get 12ms on average according to speedtest.net whereas he gets 7ms.

EDIT: I just looked into DNSmasq and it looks like it is enabled by default when forwarding mode is activated. Thus, I would like to ask you if having 4 dns servers in General Setup is better than 2 according to what you said: " So you could have say 4 different NS listed from 4 different dns services and it would ask all of them - and use the one that responds first." Will it query these 4 DNS servers?

johnpoz

@skalyx said in Big DNS Problems *Illustrated*:

EDIT: I just looked into DNSmasq and it looks like it is enabled by default when forwarding mode is activated.

OMG no it is NOT!!! There is forwarder and there is forwarding in unbound... So your using dnsmasq as your forwarder and not unbound in forward mode.

If your using the forwarder then your NOT doing dns over tls..

UGGHHH... sorry but this thread has gone for way to long.. With zero being done other then you say it works, it doesnt' work.. Can not make heads or tails of what your actually doing, etc..

skalyx

@johnpoz
Haha. I understand. I will dig into these DNS matters including DNSmasq and so on. I still am a student who is trying to figure all these things out.
I think the problem with TIDAL and DNS issues were caused by DHCP leases as I do not have them anymore with forwarding mode.
To resume:
Deactivating "Register DHCP leases in the DNS Resolver" and using forwarding mode seem to have fixed my problems.

Thanks for all the help, everyone!

johnpoz

@skalyx said in Big DNS Problems *Illustrated*:

Deactivating "Register DHCP leases in the DNS Resolver" and using forwarding mode seem to have fixed my problems

And if your using the "forwarder" dnsmasq the settings in unbound have ZERO to do with anything...

Which do you have enabled? Unbound or Forwarder?

This is unbound in forward mode

skalyx

@johnpoz Yes, I understand.
Thanks for the help and knowledge you gave me!

johnpoz

@skalyx said in Big DNS Problems *Illustrated*:

Yes, I understand.

No I don't think you do at all..

skalyx

@johnpoz
Actually, I do. I am using the unbound DNS Resolver with forwarding mode. I got that after you pointed out my mistake and some digging.

Look. I am thankful for the help. I really am, but please do not be aggressive. There are some noobs like me who try to understand things by making mistakes and learning from them. We all start from scratch, isn't it?