DNS resolver stopped resolving one hostname

silmaril

@johnpoz
Not sure what's happening here, but after I woke up this morning, resolving the problematic host is working again.

pfBlockerNG is still disabled, so I don't think it has anything to do with my whitelist entry.

I'm still trying to understand the problem. What do you mean by "is unbound running"? Which options should I check here?

(Sorry, I don't have much knowledge about DNS, until now that was just something that worked fine ).

Gertjan

@silmaril said in DNS resolver stopped resolving one hostname:

pfBlockerNG is still disabled,

Was it ( pfBlockerNG ) running when you found out that muenchen.social wasn't resolving - the first time ?
Was it resolving to something like "10.10.10.1" or just nothing at all ?

silmaril

@gertjan
As far as I can reproduce it, I am pretty sure, pfBlockerNG was not running when the problem first occured.
It did not return any IP.

When testing with Network Analyzer on an Android phone, I got a SERVFAIL error, which seems strange, because usually it's NXDOMAIN if the name cannot be resolved.

Gertjan

@silmaril said in DNS resolver stopped resolving one hostname:

Network Analyzer on an Android phone

For the next time :
Use

dig muenchen.social +trace

on the console (or : easier : ssh) access.
You'll have all answers on the screen.

Or, on a PC :

nslookup

and activate the debug :

set debug=on

Now enter :

muenchen.social

and you have all the details.

I don't have android device - neither would I use such a device for these tests.

silmaril

@gertjan said in DNS resolver stopped resolving one hostname:

@silmaril said in DNS resolver stopped resolving one hostname:

Network Analyzer on an Android phone

For the next time :
Use
dig muenchen.social +trace
on the console (or : easier : ssh) access.
You'll have all answers on the screen.

That's awesome! Thanks for this hint!

Or, on a PC :
nslookup

My PC is running Linux ;-)

I don't have android device - neither would I use such a device for these tests.

It was just interesting because of this error code - but I will use dig ... +trace, if I encounter similar problems in the future.

johnpoz

btw you can install dig on your pc.. Its a MUST have for me ;)

Just install the bind package from isc and pick tools only..

here is my windows machine

C:\>dig

; <<>> DiG 9.16.18 <<>>

if linux than yeah easy as well to install dig if you don't have it.

Gertjan

For pfSense :

pkg install bind-tools

johnpoz

@gertjan didn't they make it default installed? I know I am on clean install of pfsense+ and I don't recall installing that package..

Gertjan

@johnpoz said in DNS resolver stopped resolving one hostname:

didn't they make it default installed?

I don't think so. But I can't remember.
Installed pfSense ones, version 1 ? When I was fiddling with M0n0wall. Or something like that. Seems ages (a decade ?) to me. Been upgrading since, never re installed, it.

edit :

Joined 29 Dec 2005, 21:40

Ok, more then a decade.

johnpoz

I think it is part of base install now... When 2.5/+ came out I did clean installs.. And I don't recall having to install that, and I have dig..