didn't they make it default installed?

I don't think so. But I can't remember.
Installed pfSense ones, version 1 ? When I was fiddling with M0n0wall. Or something like that. Seems ages (a decade ?) to me. Been upgrading since, never re installed, it.

edit :

Joined 29 Dec 2005, 21:40

Ok, more then a decade.

pkg install bind-tools

Just install the bind package from isc and pick tools only..

here is my windows machine

C:\>dig

; <<>> DiG 9.16.18 <<>>

if linux than yeah easy as well to install dig if you don't have it.

@silmaril said in DNS resolver stopped resolving one hostname:

Network Analyzer on an Android phone

For the next time :
Use

dig muenchen.social +trace

on the console (or : easier : ssh) access.
You'll have all answers on the screen.

That's awesome! Thanks for this hint!

Or, on a PC :

nslookup

My PC is running Linux ;-)

I don't have android device - neither would I use such a device for these tests.

It was just interesting because of this error code - but I will use dig ... +trace, if I encounter similar problems in the future.

Network Analyzer on an Android phone

For the next time :
Use

dig muenchen.social +trace

on the console (or : easier : ssh) access.
You'll have all answers on the screen.

Or, on a PC :

nslookup

and activate the debug :

set debug=on

Now enter :

muenchen.social

and you have all the details.

I don't have android device - neither would I use such a device for these tests.

When testing with Network Analyzer on an Android phone, I got a SERVFAIL error, which seems strange, because usually it's NXDOMAIN if the name cannot be resolved.

pfBlockerNG is still disabled,

Was it ( pfBlockerNG ) running when you found out that muenchen.social wasn't resolving - the first time ?
Was it resolving to something like "10.10.10.1" or just nothing at all ?

pfBlockerNG is still disabled, so I don't think it has anything to do with my whitelist entry.

I'm still trying to understand the problem. What do you mean by "is unbound running"? Which options should I check here?

(Sorry, I don't have much knowledge about DNS, until now that was just something that worked fine ).

Do you not have it listening on loopback? You for sure should be able to do a query on pfsense going to loopback.

and just normal dig should do that too..

[21.05-RELEASE][admin@sg4860.local.lan]/root: dig muenchen.social

; <<>> DiG 9.16.15 <<>> muenchen.social
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3216
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;muenchen.social.               IN      A

;; ANSWER SECTION:
muenchen.social.        1414    IN      A       159.69.89.221

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Jul 11 16:17:48 CDT 2021
;; MSG SIZE  rcvd: 60

[21.05-RELEASE][admin@sg4860.local.lan]/root: 

You can see there it used loopback for the query.

Yes, it seems it's using itself / localhost as DNS as well as another IP which is the DSL router on the WAN interface.

An as far as I understand, it's getting the correct answer, but it doesn't tell me, if it got the same answer from both sources.

This lead me to an additional test:
I connected to the pfsense via SSH and did the dig there, too.

dig @192.168.178.1 muenchen.social returns the correct IP, but both dig @127.0.0.1 muenchen.social and dig muenchen.social don't return an answer section.

What is the output of your dns gui query? Which you say works - does it just list 127.0.0.1 or some other dns?

example - that resolves fine here, just using unbound for pfsense own queries. But if you have dns setup in general, or allowing dhcp to hand out dns to pfsense it could be using that in the gui. While if your clients ask, it would just be using unbound - which is resolving or forwarding (if so to where?)

What are you using for your local domain? Do you have any domain overrides setup, etc.

I don't think that any of the other packages should interfere with DNS.