Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [DNS Resolver] unable to resolve paypal.com sometimes

    Scheduled Pinned Locked Moved DHCP and DNS
    14 Posts 3 Posters 2.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      megagolgoth
      last edited by

      Hi,

      I activated Unbound on my pfsense appliance, and I'm unable accessing paypal.com sometimes. I make a "dig paypal.com" on different computers, and this is the same answer : no ip for paypal.com . Now it's working, maybe tomorrow it won't work.

      Pfsense up-to-date (2.3.2), DNS server configured are :
          127.0.0.1
          80.67.169.12
          80.67.169.40
          2001:910:800::12
          2001:910:800::40

      On "DNS Resolver", these option are activated :
        DNSSEC Support
        Forwarding Mode
        Register DHCP leases in the DNS Resolver
        Register DHCP static mappings in the DNS Resolver

      I don't know how to investigate this problem. I think i didn't setup correctly something, but i don't figure what… Could you help me?

      Megagolgoth

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        " Forwarding Mode"

        Well ask ns your forwarding to why its not resolving.. Do all of your forwarders support dnssec?  If your going to use the forwarder mode, you might as well just use actual forwarder atleast it can ask all of your forwarders all at the same time and use the first response.  With unbound it asks 1 at a time.  So if your first one doesn't answer then yeah you can have timeouts, etc.

        When you did, your asking pfsense or some other dns directly on your clients.  What is the status of your response when you query?

        dig paypal.com

        ; <<>> DiG 9.10.4-P2 <<>> paypal.com                                   
        ;; global options: +cmd                                                 
        ;; Got answer:                                                         
        ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 754                 
        ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 4, AUTHORITY: 4, ADDITIONAL: 1

        ;; OPT PSEUDOSECTION:                                                   
        ; EDNS: version: 0, flags:; udp: 4096                                   
        ;; QUESTION SECTION:                                                   
        ;paypal.com.                    IN      A

        ;; ANSWER SECTION:                                                     
        paypal.com.            300    IN      A      64.4.250.24             
        paypal.com.            300    IN      A      64.4.250.23             
        paypal.com.            300    IN      A      66.211.169.3           
        paypal.com.            300    IN      A      66.211.169.66

        ;; AUTHORITY SECTION:                                                   
        paypal.com.            300    IN      NS      ns2.p57.dynect.net.     
        paypal.com.            300    IN      NS      ns1.p57.dynect.net.     
        paypal.com.            300    IN      NS      ns4.p57.dynect.net.     
        paypal.com.            300    IN      NS      ns3.p57.dynect.net.

        ;; Query time: 34 msec                                                 
        ;; SERVER: 192.168.9.253#53(192.168.9.253)                             
        ;; WHEN: Sun Aug 07 05:39:48 Central Daylight Time 2016                 
        ;; MSG SIZE  rcvd: 189

        You will notice that the TTL of paypal is very short 5 minutes.. so yeah if your having issues with your dns and it has to ask over and over and over again because of the short ttl then sure your problem going to see problems with it resolving.  I show paypal.com dnssec valid, but maybe your forwarder does not support it?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • M
          megagolgoth
          last edited by

          Hi,

          For the moment i'm not able getting a resolution for paypal.com :

          $ dig paypal

          ; <<>> DiG 9.10.3-P4-Ubuntu <<>> paypal
          ;; global options: +cmd
          ;; Got answer:
          ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 62276
          ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

          ;; OPT PSEUDOSECTION:
          ; EDNS: version: 0, flags:; udp: 1280
          ;; QUESTION SECTION:
          ;paypal. IN A

          ;; AUTHORITY SECTION:
          . 39199 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2016090700 1800 900 604800 86400

          ;; Query time: 92 msec
          ;; SERVER: 127.0.1.1#53(127.0.1.1)
          ;; WHEN: Wed Sep 07 20:46:24 CEST 2016
          ;; MSG SIZE  rcvd: 110

          I didn't know much on DNS stuf…

          1 Reply Last reply Reply Quote 0
          • RonpfSR
            RonpfS
            last edited by

            Check the Resolver Logs, maybe restart it so it will log messages.

            Unbound need restart to log

            2.4.5-RELEASE-p1 (amd64)
            Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
            Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              "dig paypal"

              You didn't ask for www.paypal.com you ask for paypal. which yea not going to resolve and you got told go ask the root servers..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              1 Reply Last reply Reply Quote 0
              • RonpfSR
                RonpfS
                last edited by

                @megagolgoth:

                I don't know how to investigate this problem. I think i didn't setup correctly something, but i don't figure what… Could you help me?

                And do you need to use the Forwarding mode, why not leave the DNS Server lines empty and use unbound with Forwarding mode disabled ?

                2.4.5-RELEASE-p1 (amd64)
                Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  I am curious what your using for dns??

                  ;; SERVER: 127.0.1.1#53(127.0.1.1)

                  Tells me you asked the local host that you did the query on that was running some sort of caching dns?  Which is setup to do what resolver or forward, forward to where?  But again yeah paypal. is never in a million years going to resolve no matter what you are using..  Its not a valid fqdn on the public internet.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  1 Reply Last reply Reply Quote 0
                  • M
                    megagolgoth
                    last edited by

                    @johnpoz:

                    "dig paypal"

                    You didn't ask for www.paypal.com you ask for paypal. which yea not going to resolve and you got told go ask the root servers..

                    You're right so :
                    dig paypal.com

                    ; <<>> DiG 9.10.3-P4-Ubuntu <<>> paypal.com
                    ;; global options: +cmd
                    ;; Got answer:
                    ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 64506
                    ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

                    ;; OPT PSEUDOSECTION:
                    ; EDNS: version: 0, flags:; udp: 4096
                    ;; QUESTION SECTION:
                    ;paypal.com. IN A

                    ;; Query time: 73 msec
                    ;; SERVER: 127.0.1.1#53(127.0.1.1)
                    ;; WHEN: Wed Sep 07 21:53:37 CEST 2016
                    ;; MSG SIZE  rcvd: 3

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      ";; SERVER: 127.0.1.1#53(127.0.1.1)"

                      So what are you running on 127.0.1.1 (localhost) clearly your not on pfsense, clearly your not asking pfsense - so what is running on that box for dns?

                      Do a dig direct to one of their authoritative servers..

                      example
                      [2.3.2-RELEASE][root@pfSense.local.lan]/root: dig @ns1.p57.dynect.net paypal.com

                      ; <<>> DiG 9.10.4-P2 <<>> @ns1.p57.dynect.net paypal.com
                      ; (2 servers found)
                      ;; global options: +cmd
                      ;; Got answer:
                      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20591
                      ;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 4, ADDITIONAL: 1
                      ;; WARNING: recursion requested but not available

                      ;; OPT PSEUDOSECTION:
                      ; EDNS: version: 0, flags:; udp: 4096
                      ;; QUESTION SECTION:
                      ;paypal.com.                    IN      A

                      ;; ANSWER SECTION:
                      paypal.com.            300    IN      A      64.4.250.23
                      paypal.com.            300    IN      A      64.4.250.24

                      ;; AUTHORITY SECTION:
                      paypal.com.            300    IN      NS      ns1.p57.dynect.net.
                      paypal.com.            300    IN      NS      ns3.p57.dynect.net.
                      paypal.com.            300    IN      NS      ns4.p57.dynect.net.
                      paypal.com.            300    IN      NS      ns2.p57.dynect.net.

                      ;; Query time: 16 msec
                      ;; SERVER: 208.78.70.57#53(208.78.70.57)
                      ;; WHEN: Wed Sep 07 20:01:54 UTC 2016
                      ;; MSG SIZE  rcvd: 157

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      1 Reply Last reply Reply Quote 0
                      • M
                        megagolgoth
                        last edited by

                        I deactivate the "Enable Forwarding Mode", and it's working better.

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          again your not asking pfsense your asking something running on that local host you ran that command 127.0.1.1 is a loopback address it is only the local machine, just the same as 127.0.0.1, pfsense doesn't use that for dns, nor does pfsense out the box have dig.  So your running it on some other box that is asking itself.  Which then in turn does what?  Forwards to pfsense, forwards somewhere else?

                          Yes if you have pfsense in forwarder mode, and that forwarder or connection to that forwarder is bad then your going to have issue.  Pfsense is resolver mode will walk down from roots.  Which may or may not take a few ms longer depending on your network connectivity, etc.  But you are always sure your getting the info direct from the horses mouth..

                          For all we know what your forwarding is taking a long time..  And the second time you tried it had gotten an answer and cached it… What was the ttl on you return query that worked?

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                          1 Reply Last reply Reply Quote 0
                          • M
                            megagolgoth
                            last edited by

                            You're right

                            #netstat -tulpn |grep 53
                            tcp        0      0 192.168.122.1:53        0.0.0.0:*              LISTEN      3985/dnsmasq   
                            tcp        0      0 127.0.1.1:53            0.0.0.0:*              LISTEN      3302/dnsmasq   
                            udp        0      0 0.0.0.0:5353            0.0.0.0:*                          2597/avahi-daemon:
                            udp        0      0 192.168.122.1:53        0.0.0.0:*                          3985/dnsmasq   
                            udp        0      0 127.0.1.1:53            0.0.0.0:*                          3302/dnsmasq   
                            udp6      0      0 :::5353                :::*                                2597/avahi-daemon:

                            and

                            $ ps aux | grep 3985
                            libvirt+  3985  0.0  0.0  49984  2560 ?        S    07:03  0:00 /usr/sbin/dnsmasq –conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper

                            It's related to Qemu/KVM and LibVirt.

                            I think those provide a relay for VM and system through dnsmasq for the DNS, but dnsmasq is forwarding with no cache

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              so it doesn't cache?  that is pointless.. Where does it forward?  What is is config?

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                              1 Reply Last reply Reply Quote 0
                              • M
                                megagolgoth
                                last edited by

                                dnsmasq conf :

                                cat /var/lib/libvirt/dnsmasq/default.conf
                                [sudo] Mot de passe de dje :
                                ##WARNING:  THIS IS AN AUTO-GENERATED FILE. CHANGES TO IT ARE LIKELY TO BE
                                ##OVERWRITTEN AND LOST.  Changes to this configuration should be made using:
                                ##    virsh net-edit default

                                or other application using the libvirt API.

                                dnsmasq conf file created by libvirt

                                strict-order
                                user=libvirt-dnsmasq
                                pid-file=/var/run/libvirt/network/default.pid
                                except-interface=lo
                                bind-dynamic
                                interface=virbr0
                                dhcp-range=192.168.122.2,192.168.122.254
                                dhcp-no-override
                                dhcp-lease-max=253
                                dhcp-hostsfile=/var/lib/libvirt/dnsmasq/default.hostsfile
                                addn-hosts=/var/lib/libvirt/dnsmasq/default.addnhosts

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.