Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS Resolver Issues

    Scheduled Pinned Locked Moved
    DHCP and DNS
    2
    7
    2.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      JoeFranklin
      last edited by

      Hi there

      There may be an obvious answer to this, but I've been going around in circles for the last few hours. It seems that the DNS Resolver is adamant to not push out DNS information for one particular public domain (nhs.uk). I'm unable to traceroute, ping, nslookup, etc. Everything returns a 'can't be found' error. However, if I DNS lookup through pfSense, I get the A record without any issues. If I change the DNS server addresses on my device to Google DNS directly (which my pfSense box is using) I can retrieve the record and visit the website without any issues! Any help would be gratefully received!

      CMD console on network through pfSense

      C:\Users\Administrator>nslookup nhs.uk
      Server:  pfSense.default
      Address:  192.168.1.1

      DNS request timed out.
          timeout was 2 seconds.
      DNS request timed out.
          timeout was 2 seconds.
      *** Request to pfSense.default timed-out

      C:\Users\Administrator>ping nhs.uk
      Ping request could not find host nhs.uk. Please check the name and try again.

      DNS Lookup in pfSense

      Result Record type
      94.245.104.73 A

      [2.3.2-RELEASE][admin@pfSense.default]/root: unbound-control -c /var/unbound/unbound.conf lookup nhs.uk
      The following name servers are used for lookup of nhs.uk.
      ;rrset 86122 2 0 2 0
      nhs.uk. 172522  IN      NS      nsa.nhs.uk.
      nhs.uk. 172522  IN      NS      nsb.nhs.uk.
      ;rrset 85907 1 0 1 0
      nsb.nhs.uk.    172307  IN      A      80.2.101.230
      ;rrset 85907 1 0 1 0
      nsa.nhs.uk.    172307  IN      A      194.176.105.223
      Delegation with 2 names, of which 2 can be examined to query further addresses.
      It provides 2 IP addresses.
      194.176.105.223        rto 120000 msec, ttl 407, ping 0 var 94 rtt 376, tA 3, tAAAA 3, tother 0, probedelay 2, EDNS 0 assumed.
      80.2.101.230            rto 120000 msec, ttl 407, ping 0 var 94 rtt 376, tA 3, tAAAA 3, tother 0, probedelay 68, EDNS 0 assumed.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        resolver is working fine with that domain.

        dig  @192.168.9.253 nhs.uk ns

        ; <<>> DiG 9.11.0-P1 <<>> @192.168.9.253 nhs.uk ns
        ; (1 server found)
        ;; global options: +cmd
        ;; Got answer:
        ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 13306
        ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

        ;; OPT PSEUDOSECTION:
        ; EDNS: version: 0, flags:; udp: 4096
        ;; QUESTION SECTION:
        ;nhs.uk.                                IN      NS

        ;; ANSWER SECTION:
        nhs.uk.                86375  IN      NS      nsa.nhs.uk.
        nhs.uk.                86375  IN      NS      nsb.nhs.uk.

        ;; Query time: 1 msec
        ;; SERVER: 192.168.9.253#53(192.168.9.253)
        ;; WHEN: Mon Jan 02 04:28:33 Central Standard Time 2017
        ;; MSG SIZE  rcvd: 71

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          Your timeout error is you couldn't talk to the resolver - sure it was listening on that IP?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          1 Reply Last reply Reply Quote 0
          • J
            JoeFranklin
            last edited by

            Thanks for your reply. This is the reason why it's not making any sense! Below are nslookup responses - one going through pfSense, the other direct to Googles DNS Servers. It is definitely getting stuck at pfSense, but I have no idea why.

            pfSense DNS

            C:\Users\Administrator>nslookup google.co.uk
            Server:  pfSense.default
            Address:  192.168.1.1

            Non-authoritative answer:
            Name:    google.co.uk
            Addresses:  2a00:1450:4009:80d::2003
                      216.58.204.35

            C:\Users\Administrator>nslookup nhs.uk
            Server:  pfSense.default
            Address:  192.168.1.1

            DNS request timed out.
                timeout was 2 seconds.
            DNS request timed out.
                timeout was 2 seconds.
            *** Request to pfSense.default timed-out

            Google DNS

            C:\Users\Administrator>nslookup google.co.uk
            Server:  google-public-dns-a.google.com
            Address:  8.8.8.8

            Non-authoritative answer:
            Name:    google.co.uk
            Addresses:  2a00:1450:4009:808::2003
                      216.58.208.163

            C:\Users\Administrator>nslookup nhs.uk
            Server:  google-public-dns-a.google.com
            Address:  8.8.8.8

            Non-authoritative answer:
            Name:    nhs.uk
            Address:  94.245.104.73

            It also affects all devices on the network - iPhones, iPads, etc. so it's not just one device it's happening on.

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              You do understand how the resolver works right??  It walks down from roots to the authoritative server.. If it can not talk to the authoritative severs, or it takes to long then yeah it will have problems..

              I am showing no issues with the resolving that fqdn.. You need to figure out where your having a network issue that is causing you a problem..

              Do say a dig +trace or debug with nslookup to find out where you having an issue talking to NS in the resolve process..

              see can resolve it down from roots without any issue.

              dig nhs.uk +trace

              ; <<>> DiG 9.11.0-P1 <<>> nhs.uk +trace
              ;; global options: +cmd
              .                      501482  IN      NS      h.root-servers.net.
              .                      501482  IN      NS      e.root-servers.net.
              .                      501482  IN      NS      k.root-servers.net.
              .                      501482  IN      NS      m.root-servers.net.
              .                      501482  IN      NS      a.root-servers.net.
              .                      501482  IN      NS      c.root-servers.net.
              .                      501482  IN      NS      g.root-servers.net.
              .                      501482  IN      NS      f.root-servers.net.
              .                      501482  IN      NS      b.root-servers.net.
              .                      501482  IN      NS      i.root-servers.net.
              .                      501482  IN      NS      d.root-servers.net.
              .                      501482  IN      NS      j.root-servers.net.
              .                      501482  IN      NS      l.root-servers.net.
              .                      501482  IN      RRSIG  NS 8 0 518400 20170115050000 20170102040000 61045 . IPMIhhdfD4IDsgpJw1TGLp93u1E9eA1HiHd5LxQsXs0RohWm4nZQk984 k77Xzjjx3bnBttvMV+SVc+X7AxQDVYxNAQIeB3Qn4ZVKBSCj2gRC+hs9 YR0IcU0TnG6IuIu+BFk4AKT53kjxfYE3yJVxYcZM+hzOexXKfFwHjzbe XAyLD78M+oFX41IMlJob8uxcO3t3nnWLR/a3jxdWLG6IV6DMMAYdxAd5 JZbNATNxP+RNEYau3KsXkit5Pxm6iiRyMKiu/aonJzK5FAspww0TvHJk SwLdDPuOCCbKyjku6X6zHIOCruF9DQihpuwdrRHxIXr7+tcKrE9iveV4 Wq312Q==
              ;; Received 525 bytes from 192.168.3.10#53(192.168.3.10) in 4 ms

              uk.                    172800  IN      NS      dns2.nic.uk.
              uk.                    172800  IN      NS      dns1.nic.uk.
              uk.                    172800  IN      NS      nsc.nic.uk.
              uk.                    172800  IN      NS      nsd.nic.uk.
              uk.                    172800  IN      NS      dns3.nic.uk.
              uk.                    172800  IN      NS      nsa.nic.uk.
              uk.                    172800  IN      NS      dns4.nic.uk.
              uk.                    172800  IN      NS      nsb.nic.uk.
              uk.                    86400  IN      DS      43876 8 2 A107ED2AC1BD14D924173BC7E827A1153582072394F9272BA37E2353 BC659603
              uk.                    86400  IN      RRSIG  DS 8 1 86400 20170115050000 20170102040000 61045 . HBsDVNwfRprjMNrJk6HD+RxOD+TVjyj88/hhwwyt47DJ+DdEmyxnBTNF IvhK7imOI85ahg7/FVnznZBwz28T/pswRowNMtAWrIKf1rQ8qEkQHvbt pP2p3TAINCTNsQ3DIA+QimgC216g+SsmulzLnnkL6Rvn7YDa4zdt8of2 iGDTrgPyRfsk7E8NPEoTxqxW4rffJaEYU9C0csAughFKmrb80B8iDNXX naUnwUOAULTfcGz84KoswRIn15Cdf4qi5MyayNw/sdVKWo5NEHgfDfEl 19p65HAnZDR57G9A0CZ79mFezRTqH8mVwodGa3Zt53Xjcrr7SeF9Pp7C UlpTDw==
              ;; Received 790 bytes from 192.36.148.17#53(i.root-servers.net) in 64 ms

              nhs.uk.                172800  IN      NS      nsa.nhs.uk.
              nhs.uk.                172800  IN      NS      nsb.nhs.uk.
              U1FMKLFV3RDCNAMDC64SEKGCDP05BBIU.uk. 10800 IN NSEC3 1 1 0 - U1LG7J6JO1NFSU55LON2UMGEUJO912TU  NS SOA RRSIG DNSKEY NSEC3PARAM TYPE65534
              U1FMKLFV3RDCNAMDC64SEKGCDP05BBIU.uk. 10800 IN RRSIG NSEC3 8 2 10800 20170116021546 20170102013947 43056 uk. Mm5vXay9NZ6Hxqga6cuTcGYJJgBgKCYKZUBhvMUPzRUv1w3JCKMmZTxq XBADATsAE+JfIBNIOiGufycbX3wTL3lnqWKOykXQ+XoUW4T65tumjgi3 Gw7oUPhAYJgLVcjhPH4g5+AZ7dO/2hEDoW1uFLOYUcFt81lubPC+fXCS R9c=
              M1UA9SJ26NB3S6PJCVOKFGCI189MTH0H.uk. 10800 IN NSEC3 1 1 0 - M24EVKII04A4OCQ1QGOQ98FFTFUD4LPB  NS DS RRSIG
              M1UA9SJ26NB3S6PJCVOKFGCI189MTH0H.uk. 10800 IN RRSIG NSEC3 8 2 10800 20170115181727 20170101175145 43056 uk. lp0B4DM3n8+TVZYktyn8fmJRjq/EW7EfZOA9Li1zoUudSq9oQE/NL6xb NSqGhyM0pEKbIleEpSflFqGmj8GDbr1G/4AeR8Cup1iy6RA2xgAcCVDX +2WyCJf0HwwF32o7Nj3bZ1s2OzHVJzKq6laVXOvUlv9n/tbiqIjtCGXK WSM=
              ;; Received 620 bytes from 156.154.100.3#53(nsa.nic.uk) in 21 ms

              nhs.uk.                300    IN      A      94.245.104.73
              ;; Received 51 bytes from 80.2.101.230#53(nsb.nhs.uk) in 130 ms

              You can see in the trace - asked
              Received 790 bytes from 192.36.148.17#53(i.root-servers.net) in 64 ms
              Hey whats the NS for uk..
              Then asked one of them
              Received 620 bytes from 156.154.100.3#53(nsa.nic.uk)
              Hey whats ns for nhs.uk
              ;; Received 51 bytes from 80.2.101.230#53(nsb.nhs.uk)

              Then when an asked it - and got the A record I was looking for..

              Turn up the verbosity of unbound - what does the log show you when you try and query for that?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              1 Reply Last reply Reply Quote 0
              • J
                JoeFranklin
                last edited by

                Thank you for your feedback - below are some dig responses. Looking at these I would initially put it down as a third party issue, but when changing the name servers to Google on a networked device, I get no issues at all!

                [2.3.2-RELEASE][admin@pfSense.default]/var/log: dig nhs.uk trace

                ; <<>> DiG 9.10.4-P2 <<>> nhs.uk trace
                ;; global options: +cmd
                ;; Got answer:
                ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 33396
                ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

                ;; OPT PSEUDOSECTION:
                ; EDNS: version: 0, flags:; udp: 4096
                ;; QUESTION SECTION:
                ;nhs.uk.                                IN      A

                ;; Query time: 0 msec
                ;; SERVER: 127.0.0.1#53(127.0.0.1)
                ;; WHEN: Mon Jan 02 19:01:20 GMT 2017
                ;; MSG SIZE  rcvd: 35

                ;; Got answer:
                ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 55914
                ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

                ;; OPT PSEUDOSECTION:
                ; EDNS: version: 0, flags:; udp: 4096
                ;; QUESTION SECTION:
                ;trace.                        IN      A

                ;; AUTHORITY SECTION:
                .                      1479    IN      SOA    a.root-servers.net. nstld.verisign-grs.com. 2017010201 1800 900 604800 86400

                ;; Query time: 0 msec
                ;; SERVER: 127.0.0.1#53(127.0.0.1)
                ;; WHEN: Mon Jan 02 19:01:20 GMT 2017
                ;; MSG SIZE  rcvd: 109

                [2.3.2-RELEASE][admin@STEVE-pfSense.default]/var/log: dig nhs.uk trace

                ; <<>> DiG 9.10.4-P2 <<>> nhs.uk trace
                ;; global options: +cmd
                ;; Got answer:
                ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 33396
                ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

                ;; OPT PSEUDOSECTION:
                ; EDNS: version: 0, flags:; udp: 4096
                ;; QUESTION SECTION:
                ;nhs.uk.                                IN      A

                ;; Query time: 0 msec
                ;; SERVER: 127.0.0.1#53(127.0.0.1)
                ;; WHEN: Mon Jan 02 19:01:20 GMT 2017
                ;; MSG SIZE  rcvd: 35

                ;; Got answer:
                ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 55914
                ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

                ;; OPT PSEUDOSECTION:
                ; EDNS: version: 0, flags:; udp: 4096
                ;; QUESTION SECTION:
                ;trace.                        IN      A

                ;; AUTHORITY SECTION:
                .                      1479    IN      SOA    a.root-servers.net. nstld.verisign-grs.com. 2017010201 1800 900 604800 86400

                ;; Query time: 0 msec
                ;; SERVER: 127.0.0.1#53(127.0.0.1)
                ;; WHEN: Mon Jan 02 19:01:20 GMT 2017
                ;; MSG SIZE  rcvd: 109

                It appears I'm getting a SERVFAIL. Every so often I will be able to obtain a A record from pfSense directly if I keep flushing nhs.uk out of unbound, but that never materialises to the networked machines.

                Looking at the unbound logs too, right at the end of a very long query, these lines appeared.

                Jan  2 18:24:53 pfSense unbound: [44139:0] debug: No more query targets, attempting last resort
                Jan  2 18:24:53 pfSense unbound: [44139:0] info: found in cache nsb.nhs.uk. A IN
                Jan  2 18:24:53 pfSense unbound: [44139:0] info: found in cache nsa.nhs.uk. A IN
                Jan  2 18:24:53 pfSense unbound: [44139:0] info: found parent-side nsb.nhs.uk. A IN
                Jan  2 18:24:53 pfSense unbound: [44139:0] info: found parent-side nsb.nhs.uk. AAAA IN
                Jan  2 18:24:53 pfSense unbound: [44139:0] info: found parent-side nsa.nhs.uk. A IN
                Jan  2 18:24:53 pfSense unbound: [44139:0] info: found parent-side nsa.nhs.uk. AAAA IN
                Jan  2 18:24:53 pfSense unbound: [44139:0] debug: out of query targets – returning SERVFAIL
                Jan  2 18:24:53 pfSense unbound: [44139:0] debug: store error response in message cache
                Jan  2 18:24:53 pfSense unbound: [44139:0] debug: return error response SERVFAIL
                Jan  2 18:24:53 pfSense unbound: [44139:0] debug: mesh_run: iterator module exit state is module_finished
                Jan  2 18:24:53 pfSense unbound: [44139:0] debug: validator[module 0] operate: extstate:module_wait_module event:module_event_moddone
                Jan  2 18:24:53 pfSense unbound: [44139:0] info: validator operate: query nhs.uk. A IN
                Jan  2 18:24:53 pfSense unbound: [44139:0] debug: validator: nextmodule returned
                Jan  2 18:24:53 pfSense unbound: [44139:0] debug: cannot validate non-answer, rcode SERVFAIL
                Jan  2 18:24:53 pfSense unbound: [44139:0] debug: mesh_run: validator module exit state is module_finished
                Jan  2 18:24:53 pfSense unbound: [44139:0] info: send_udp over interface: 172.16.0.1
                Jan  2 18:24:53 pfSense unbound: [44139:0] debug: query took 24.494277 sec

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  "but when changing the name servers to Google on a networked device"

                  So again you don't understand how a resolver works ;)  Nor how to use the trace command that I clearly posted.. Where is your **+**trace??  Your asking that server for the record trace in that format..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post