<![CDATA[Intermittently losing DNS]]>I using pfsense 2.4.4 and just recently noticed intermittently I'm loosing my DNS. When I ping www.google.com from my computer I get Host name lookup failure. I'm using Quad9 DNS servers over TLS. Adding 208.67.220.220 to the System/General setup/DNS Server Settings will fix it.
I've tried upgrading to 2.4.4_1 and getting the same problem. I believe this problem started after trying to migrate to new hardware but I'm back on the original pfsense box without any configuration changes.
I have no idea what the issue is.

]]>https://forum.netgate.com/topic/138738/intermittently-losing-dnsRSS for NodeMon, 13 Jul 2026 09:43:53 GMTSat, 15 Dec 2018 01:06:31 GMT60<![CDATA[Reply to Intermittently losing DNS on Sun, 17 Feb 2019 03:52:26 GMT]]>@naskar

I don't have a good answer for you about enabling DNSSEC when using Cloudflare DoT. The sites that do support DNSSEC are few. I saw something the other day that DNSSEC sites are in the single digit percentage of all sites on the internet. I added the DNSSEC detector add-on on Firefox and I can confirm from my own experience that not too many sites I visit support DNSSEC. With DNSSEC disabled on the DNS Resolver, I still pass all of the DNSSEC tests on these sites:

This thread does shed some light on the topic.

]]>https://forum.netgate.com/post/824460https://forum.netgate.com/post/824460Sun, 17 Feb 2019 03:52:26 GMT<![CDATA[Reply to Intermittently losing DNS on Sat, 19 Jan 2019 14:52:40 GMT]]>@xentrk said in Intermittently losing DNS:

@naskar
Yes, Cloudflare was the other DNS we tested with and it had no issues like Quad 9. It seems to play better. Just note that the Cloudflare help site https://1.1.1.1/help does not support DNSSEC and will fail the DoT test if you have DNSSEC turned on.

I changed to Cloudfare and have DNSSEC enabled and it seems to be working. But after going to your link I realized that DoT wasn't working. After turning it off DoT works. Is DNSSSEC not important? Is it ok to not use it?

Or are you just saying leave DNSSEC on and ignore what the https://1.1.1.1/help says about DoT?

]]>https://forum.netgate.com/post/818547https://forum.netgate.com/post/818547Sat, 19 Jan 2019 14:52:40 GMT<![CDATA[Reply to Intermittently losing DNS on Sat, 19 Jan 2019 11:51:20 GMT]]>@naskar
Yes, Cloudflare was the other DNS we tested with and it had no issues like Quad 9. It seems to play better. Just note that the Cloudflare help site https://1.1.1.1/help does not support DNSSEC and will fail the DoT test if you have DNSSEC turned on.

]]>https://forum.netgate.com/post/818530https://forum.netgate.com/post/818530Sat, 19 Jan 2019 11:51:20 GMT<![CDATA[Reply to Intermittently losing DNS on Fri, 18 Jan 2019 20:55:23 GMT]]>@xentrk said in Intermittently losing DNS:

@naskar

Quad9 appears to have issue resolving when using DNSSEC from recent testing I and others have done recently. Sometimes a refresh or two is required to load the page.

Would I be better off switching to Cloudflare’s DNS service?

@gertjan said in Intermittently losing DNS:

A correct time is very important for DNSSEC.
Can you have DNSSEC and Use SSL/TLS for outgoing DNS Queries to forwarding servers?

]]>https://forum.netgate.com/post/818469https://forum.netgate.com/post/818469Fri, 18 Jan 2019 20:55:23 GMT<![CDATA[Reply to Intermittently losing DNS on Fri, 18 Jan 2019 07:47:33 GMT]]>A correct time is very important for DNSSEC.

]]>https://forum.netgate.com/post/818323https://forum.netgate.com/post/818323Fri, 18 Jan 2019 07:47:33 GMT<![CDATA[Reply to Intermittently losing DNS on Fri, 18 Jan 2019 04:06:35 GMT]]>@naskar

Quad9 appears to have issue resolving when using DNSSEC from recent testing I and others have done recently. Sometimes a refresh or two is required to load the page.

]]>https://forum.netgate.com/post/818305https://forum.netgate.com/post/818305Fri, 18 Jan 2019 04:06:35 GMT<![CDATA[Reply to Intermittently losing DNS on Mon, 31 Dec 2018 23:08:45 GMT]]>Could a problem with the ntp server cause dns issues?
I reset my system clock to the correct time and changed the NTP server to the WAN interface.
So far DNS is working.
Is the best way to check looking at the DNS resolver log and seeing entries with "A IN NOERROR 0.057908 0 58" in it?

]]>https://forum.netgate.com/post/814491https://forum.netgate.com/post/814491Mon, 31 Dec 2018 23:08:45 GMT<![CDATA[Reply to Intermittently losing DNS on Tue, 18 Dec 2018 01:40:51 GMT]]>I'm not sure but I think the intermittent loss of DNS was due to running out of memory. After I removed snort which was eating up my memory the intermittent nature resolved. Does that sound like that issue would cause that problem?

My DNS stops working when I enable Quad9 DNS servers over TLS. Here are my settings.

0_1545097011864_TLS-00.jpg
Firewall/rules/LAN
0_1545097019903_TLS-01.jpg
System/General Setup/DNS Server Settings
0_1545097025507_TLS-02.jpg
Error in web browser
0_1545097031263_TLS-03.jpg

]]>https://forum.netgate.com/post/811860https://forum.netgate.com/post/811860Tue, 18 Dec 2018 01:40:51 GMT<![CDATA[Reply to Intermittently losing DNS on Mon, 17 Dec 2018 15:12:29 GMT]]>I've noticed that sometimes some of the public servers intermittently fail when using DNS over TLS or DNSSEC.

]]>https://forum.netgate.com/post/811668https://forum.netgate.com/post/811668Mon, 17 Dec 2018 15:12:29 GMT