Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can not resolve a DNS

    Scheduled Pinned Locked Moved General pfSense Questions
    55 Posts 4 Posters 6.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C Offline
      Chrismallia
      last edited by

      Hi I have a problem with resolving 1 site that is https://www.melita.com/ I get page error when using pfsense on other routers it works fine.  Any ideas on this please? btw I used the old forwarder it gets resolved fine so it is something in resolver

      1 Reply Last reply Reply Quote 0
      • D Offline
        doktornotor Banned
        last edited by

        
        drill www.melita.com
        ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 50998
        ;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0
        ;; QUESTION SECTION:
        ;; www.melita.com.      IN      A
        
        ;; ANSWER SECTION:
        www.melita.com. 86371   IN      A       212.56.128.204
        
        ;; AUTHORITY SECTION:
        melita.com.     86371   IN      NS      ns1.melitacable.com.
        melita.com.     86371   IN      NS      ns.melitacable.com.
        
        ;; ADDITIONAL SECTION:
        
        ;; Query time: 0 msec
        ;; SERVER: 127.0.0.1
        ;; WHEN: Sat Nov 26 23:21:29 2016
        ;; MSG SIZE  rcvd: 95
        
        

        Works just fine.

        1 Reply Last reply Reply Quote 0
        • johnpozJ Offline
          johnpoz LAYER 8 Global Moderator
          last edited by

          yup working just fine here as well..

          
          > dig www.melita.com                                                     
          
          ; <<>> DiG 9.11.0-P1 <<>> www.melita.com                                 
          ;; global options: +cmd                                                  
          ;; Got answer:                                                           
          ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62636                
          ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1     
          
          ;; OPT PSEUDOSECTION:                                                    
          ; EDNS: version: 0, flags:; udp: 4096                                    
          ;; QUESTION SECTION:                                                     
          ;www.melita.com.                        IN      A                        
          
          ;; ANSWER SECTION:                                                       
          www.melita.com.         86400   IN      A       212.56.128.204           
          
          ;; AUTHORITY SECTION:                                                    
          melita.com.             86400   IN      NS      ns1.melitacable.com.     
          melita.com.             86400   IN      NS      ns.melitacable.com.      
          
          ;; Query time: 197 msec                                                  
          ;; SERVER: 192.168.9.253#53(192.168.9.253)                               
          ;; WHEN: Sat Nov 26 16:24:16 Central Standard Time 2016                  
          ;; MSG SIZE  rcvd: 106                                                   
          
          

          What do you get back?  Servfail, nx, timeout?  Its quite possible with how resolving works that your having issues with connectivity to their NS.. Can you query them directly?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • C Offline
            Chrismallia
            last edited by

            Hi thanks for your reply and testing it out MM that is strange cos I always had this problem on different installs and different hardware, I wish  I can resolve this as melita is our ISP here and we need it.

            1 Reply Last reply Reply Quote 0
            • C Offline
              Chrismallia
              last edited by

              A My friend johnpoz  love to hear from you :)  I get a page error This site can’t be reached

              1 Reply Last reply Reply Quote 0
              • johnpozJ Offline
                johnpoz LAYER 8 Global Moderator
                last edited by

                no with an actual tool that does a query.. page can not be reached doesn't mean your dns didn't work..

                Use drill like dok did, or dig or host or nslookup.. A tools that actually does a query that you can see the results in.. For all you know your browser is looking in its cache that it got back a nx before.. and has to wait for the neg cache to expire..

                Your browser has a dns cache, your OS dns client has a cache, pfsense has a cache.  You need to understand what is exactly happening.. And if you can not query or just some browser error, or maybe the site failed..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • C Offline
                  Chrismallia
                  last edited by

                  when I do dns lookup melita.com it results the ip fine. when I ping melita.com from a windows cms I get >ping melita.com
                  Ping request could not find host melita.com. Please check the name and try again. when I ping the ip it pings fine

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ Offline
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    windows "cms" ?? what is that? content management system?  did you mean command prompt?

                    what are you using for dns lookup - what tool?  And what are you doing the query too?  Maybe your machine is infected with something and hijacking connections??

                    Please post your ping command and your "dns" command output.

                    ping melita.com

                    Pinging melita.com [212.56.128.204] with 32 bytes of data:
                    Reply from 212.56.128.204: bytes=32 time=157ms TTL=53
                    Reply from 212.56.128.204: bytes=32 time=157ms TTL=53
                    Reply from 212.56.128.204: bytes=32 time=157ms TTL=53
                    Reply from 212.56.128.204: bytes=32 time=157ms TTL=53

                    Ping statistics for 212.56.128.204:
                        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
                    Approximate round trip times in milli-seconds:
                        Minimum = 157ms, Maximum = 157ms, Average = 157ms

                    And again going to mention your dns tools will do a direct query, doing a ping could be getting answer from you OS dns client cache of neg response.  If your saying yoru dns query works..  The flush your windows local cache and try your ping by name again

                    ipconfig /flushdns

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • C Offline
                      Chrismallia
                      last edited by

                      Hi  I hit the s  by mistake I meant CMD. There is nothing wrong with the machines I tried the same on a fresh install laptop with same results, now when I change my dns settings manually in windows to google it opens the site fine and this is happening across all my machines phones and I also have a linux Manjaro pc same problem. I  used dns lookup in pfsense and it resolves it fine but on clients no

                      C:\Users\Chris>ping melita.com
                      Ping request could not find host melita.com. Please check the name and try again.

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ Offline
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        but if you do a dns query via nslookup or dig or drill or host from that same machine your saying it resolves??

                        If so then flush the machines local cache and try your ping again!!

                        from your cmd, ipconfig /flushdns

                        dns query for it - does it work?

                        then ping it..

                        If ping says can not resolve then you got something wrong on the machines built in dns client.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • C Offline
                          Chrismallia
                          last edited by

                          I flushed it but same problem I did nslookup in cmd

                          C:\Users\Chris>nslookup 212.56.128.204
                          Server:  pfSense.localdomain
                          Address:  192.168.0.1

                          DNS request timed out.
                              timeout was 2 seconds.
                          *** Request to pfSense.localdomain timed-out

                          C:\Users\Chris>nslookup melita.com
                          Server:  pfSense.localdomain
                          Address:  192.168.0.1

                          *** pfSense.localdomain can't find melita.com: Server failed

                          I am sure it is not my machines/devices as  using google dns on the machines or replacing pfsense with a different router  solves it

                          1 Reply Last reply Reply Quote 0
                          • C Offline
                            Chrismallia
                            last edited by

                            Ping from the pfsense box works  Diagnostics/ping

                            PING melita.com (212.56.128.204): 56 data bytes
                            64 bytes from 212.56.128.204: icmp_seq=0 ttl=60 time=9.888 ms
                            64 bytes from 212.56.128.204: icmp_seq=1 ttl=60 time=11.754 ms
                            64 bytes from 212.56.128.204: icmp_seq=2 ttl=60 time=16.079 ms

                            –- melita.com ping statistics ---
                            3 packets transmitted, 3 packets received, 0.0% packet loss
                            round-trip min/avg/max/stddev = 9.888/12.574/16.079/2.593 ms

                            The problems looks between the pfsense and devices communication

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ Offline
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              C:\Users\Chris>nslookup melita.com
                              Server:  pfSense.localdomain
                              Address:  192.168.0.1

                              *** pfSense.localdomain can't find melita.com: Server failed

                              Yeah sure looks like your having a issue resolving it.. Do you have pfsense using itself for dns??  Or do you have it using something else??  Thought you said your dns query for it worked??  From that you first got a timeout, pfsense was trying to resolve??  Then you get back serv failed..  Which normally means could not talk to the NS it..  So is psfense using itself, ie this will use resolver out of the box in resolver mode and pfsense asking the resolver for stuff it wants to resolve.

                              nslookup is not as good at helping debug dns issues as dig is.  What I would suggest you do is install dig on your windows box, or use linux with dig or drill and do a trace..  This will talk to the roots and walk down the tree just like unbound does in resolver mode.  This should tell you where there is an issue.

                              so example..

                              
                              > dig +trace +nodnssec melita.com
                              
                              ; <<>> DiG 9.11.0-P1 <<>> +trace +nodnssec melita.com
                              ;; global options: +cmd
                              .                       494382  IN      NS      j.root-servers.net.
                              .                       494382  IN      NS      m.root-servers.net.
                              .                       494382  IN      NS      a.root-servers.net.
                              .                       494382  IN      NS      c.root-servers.net.
                              .                       494382  IN      NS      e.root-servers.net.
                              .                       494382  IN      NS      d.root-servers.net.
                              .                       494382  IN      NS      k.root-servers.net.
                              .                       494382  IN      NS      h.root-servers.net.
                              .                       494382  IN      NS      f.root-servers.net.
                              .                       494382  IN      NS      i.root-servers.net.
                              .                       494382  IN      NS      b.root-servers.net.
                              .                       494382  IN      NS      l.root-servers.net.
                              .                       494382  IN      NS      g.root-servers.net.
                              ;; Received 239 bytes from 192.168.9.253#53(192.168.9.253) in 0 ms
                              
                              com.                    172800  IN      NS      a.gtld-servers.net.
                              com.                    172800  IN      NS      b.gtld-servers.net.
                              com.                    172800  IN      NS      c.gtld-servers.net.
                              com.                    172800  IN      NS      d.gtld-servers.net.
                              com.                    172800  IN      NS      e.gtld-servers.net.
                              com.                    172800  IN      NS      f.gtld-servers.net.
                              com.                    172800  IN      NS      g.gtld-servers.net.
                              com.                    172800  IN      NS      h.gtld-servers.net.
                              com.                    172800  IN      NS      i.gtld-servers.net.
                              com.                    172800  IN      NS      j.gtld-servers.net.
                              com.                    172800  IN      NS      k.gtld-servers.net.
                              com.                    172800  IN      NS      l.gtld-servers.net.
                              com.                    172800  IN      NS      m.gtld-servers.net.
                              ;; Received 527 bytes from 192.203.230.10#53(e.root-servers.net) in 15 ms
                              
                              melita.com.             172800  IN      NS      ns.melitacable.com.
                              melita.com.             172800  IN      NS      ns1.melitacable.com.
                              ;; Received 118 bytes from 192.55.83.30#53(m.gtld-servers.net) in 124 ms
                              
                              melita.com.             86400   IN      A       212.56.128.204
                              melita.com.             86400   IN      NS      ns1.melitacable.com.
                              melita.com.             86400   IN      NS      ns.melitacable.com.
                              ;; Received 134 bytes from 212.56.128.132#53(ns.melitacable.com) in 156 ms
                              
                              

                              You see it get roots, ask them for NS for .com, then ask .com NS who is NS for melita.com, then ask one of those NS for for the A record..

                              You can just download dig for free as part of bind, then just install the "tools" 
                              https://www.isc.org/downloads/

                              Or just do it direct from pfsense with drill

                              
                              [2.3.2-RELEASE][root@pfsense.local.lan]/root: drill -T melita.com
                              com.    172800  IN      NS      h.gtld-servers.net.
                              com.    172800  IN      NS      l.gtld-servers.net.
                              com.    172800  IN      NS      a.gtld-servers.net.
                              com.    172800  IN      NS      e.gtld-servers.net.
                              com.    172800  IN      NS      f.gtld-servers.net.
                              com.    172800  IN      NS      d.gtld-servers.net.
                              com.    172800  IN      NS      g.gtld-servers.net.
                              com.    172800  IN      NS      j.gtld-servers.net.
                              com.    172800  IN      NS      b.gtld-servers.net.
                              com.    172800  IN      NS      m.gtld-servers.net.
                              com.    172800  IN      NS      k.gtld-servers.net.
                              com.    172800  IN      NS      i.gtld-servers.net.
                              com.    172800  IN      NS      c.gtld-servers.net.
                              melita.com.     172800  IN      NS      ns.melitacable.com.
                              melita.com.     172800  IN      NS      ns1.melitacable.com.
                              melita.com.     86400   IN      A       212.56.128.204
                              melita.com.     86400   IN      NS      ns1.melitacable.com.
                              melita.com.     86400   IN      NS      ns.melitacable.com.
                              
                              

                              If it fails - you can u the verbosity with

                              drill -T -V 5 melita.com

                              pfsensedns.png
                              pfsensedns.png_thumb

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • C Offline
                                Chrismallia
                                last edited by

                                Hi here is the dig

                                C:\Users\Chris>dig melita.com

                                ; <<>> DiG 9.11.0-P1 <<>> melita.com
                                ;; global options: +cmd
                                ;; Got answer:
                                ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 661
                                ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

                                ;; OPT PSEUDOSECTION:
                                ; EDNS: version: 0, flags:; udp: 4096
                                ; COOKIE: 95b8d2028f289628 (echoed)
                                ;; QUESTION SECTION:
                                ;melita.com.                    IN      A

                                ;; Query time: 0 msec
                                ;; SERVER: 192.168.0.1#53(192.168.0.1)
                                ;; WHEN: Sun Nov 27 16:04:07 W. Europe Standard Time 2016
                                ;; MSG SIZE  rcvd: 51

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ Offline
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by

                                  No this not the dig I showed you.. Do a full trace.. and forget any dnssec stuff.. Maybe that is what is failing for you, which is why lets do it without the dnssec, etc.

                                  dig +trace +nodnssec melita.com

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • C Offline
                                    Chrismallia
                                    last edited by

                                    :) sorry is this it

                                    C:\Users\Chris>dig trace nodnssec melita.com

                                    ; <<>> DiG 9.11.0-P1 <<>> trace nodnssec melita.com
                                    ;; global options: +cmd
                                    ;; Got answer:
                                    ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 539
                                    ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

                                    ;; OPT PSEUDOSECTION:
                                    ; EDNS: version: 0, flags:; udp: 4096
                                    ;; QUESTION SECTION:
                                    ;trace.                        IN      A

                                    ;; AUTHORITY SECTION:
                                    .                      2594    IN      SOA    a.root-servers.net. nstld.verisign-grs.com. 2016112700 1800 900 604800 86400

                                    ;; Query time: 63 msec
                                    ;; SERVER: 192.168.0.1#53(192.168.0.1)
                                    ;; WHEN: Sun Nov 27 16:35:12 W. Europe Standard Time 2016
                                    ;; MSG SIZE  rcvd: 109

                                    ;; Got answer:
                                    ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 44812
                                    ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

                                    ;; OPT PSEUDOSECTION:
                                    ; EDNS: version: 0, flags:; udp: 4096
                                    ;; QUESTION SECTION:
                                    ;nodnssec.                      IN      A

                                    ;; AUTHORITY SECTION:
                                    .                      2594    IN      SOA    a.root-servers.net. nstld.verisign-grs.com. 2016112700 1800 900 604800 86400

                                    ;; Query time: 62 msec
                                    ;; SERVER: 192.168.0.1#53(192.168.0.1)
                                    ;; WHEN: Sun Nov 27 16:35:12 W. Europe Standard Time 2016
                                    ;; MSG SIZE  rcvd: 112

                                    ;; connection timed out; no servers could be reached

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ Offline
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      Dude copy and paste!!  you need the + signs…

                                      do you not even read what it outputs

                                      ;; QUESTION SECTION:
                                      ;trace.                        IN      A

                                      Are you hungover or something?  Need a cup of coffee or 3?

                                      edit:  Oh your EU time.. Maybe your already started hitting the hooch? ;)

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • C Offline
                                        Chrismallia
                                        last edited by

                                        C:\Users\Chris>dig +trace +nodnssec melita.com

                                        ; <<>> DiG 9.11.0-P1 <<>> +trace +nodnssec melita.com
                                        ;; global options: +cmd
                                        ;; Received 12 bytes from 192.168.0.1#53(192.168.0.1) in 0 ms

                                        :) sorry

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ Offline
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          that is your full output??

                                          Is 192.168.0.1 pfsense?  And you have it resolver mode?  It should of atleast given you the root servers..  You got something wrong..

                                          Try it with just the +trace option

                                          dig +trace melita.com

                                          Also dig NS what does that give you back?

                                          
                                          C:\>dig NS
                                          
                                          ; <<>> DiG 9.11.0-P1 <<>> NS
                                          ;; global options: +cmd
                                          ;; Got answer:
                                          ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33584
                                          ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 1
                                          
                                          ;; OPT PSEUDOSECTION:
                                          ; EDNS: version: 0, flags:; udp: 4096
                                          ;; QUESTION SECTION:
                                          ;.                              IN      NS
                                          
                                          ;; ANSWER SECTION:
                                          .                       487240  IN      NS      j.root-servers.net.
                                          .                       487240  IN      NS      m.root-servers.net.
                                          .                       487240  IN      NS      a.root-servers.net.
                                          .                       487240  IN      NS      c.root-servers.net.
                                          .                       487240  IN      NS      e.root-servers.net.
                                          .                       487240  IN      NS      d.root-servers.net.
                                          .                       487240  IN      NS      k.root-servers.net.
                                          .                       487240  IN      NS      h.root-servers.net.
                                          .                       487240  IN      NS      f.root-servers.net.
                                          .                       487240  IN      NS      i.root-servers.net.
                                          .                       487240  IN      NS      b.root-servers.net.
                                          .                       487240  IN      NS      l.root-servers.net.
                                          .                       487240  IN      NS      g.root-servers.net.
                                          
                                          ;; Query time: 0 msec
                                          ;; SERVER: 192.168.9.253#53(192.168.9.253)
                                          ;; WHEN: Sun Nov 27 09:49:40 Central Standard Time 2016
                                          ;; MSG SIZE  rcvd: 239
                                          
                                          

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • C Offline
                                            Chrismallia
                                            last edited by

                                            yes 192.168.0.1 is my pfsense and left everything default

                                            C:\Users\Chris>dig +trace melita.com

                                            ; <<>> DiG 9.11.0-P1 <<>> +trace melita.com
                                            ;; global options: +cmd
                                            ;; Received 12 bytes from 192.168.0.1#53(192.168.0.1) in 0 ms

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.