Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login
    Introducing Netgate Nexus: Multi-Instance Management at Your Fingertips.

    Domain being appended to ews.netgate.com and acb.netgate.com queries

    Scheduled Pinned Locked Moved DHCP and DNS
    dnsbinddomainquery
    7 Posts 3 Posters 2.7k Views 4 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D Offline
      dono
      last edited by

      While monitoring my external BIND DNS servers (10.10.40.21, 10.10.40.22) I noticed the following queries sourced from the pfSense gateway (10.10.40.254).

      $ grep -i "netgate.com" /var/log/named/queries.log
22-Jun-2026 19:06:00.528 queries: info: client @0x6a9fc800 10.10.40.254#30836 (ews.netgate.com.foo.org): query: ews.netgate.com.foo.org IN SRV +E(0)D (10.10.40.21)
22-Jun-2026 19:26:54.881 queries: info: client @0x6cf5cc00 10.10.40.254#26044 (acb.netgate.com.foo.org): query: acb.netgate.com.foo.org IN AAAA +E(0)D (10.10.40.21)

$grep -i "netgate.com" /var/log/named/queries.log
22-Jun-2026 19:26:55.039 queries: info: client @0x6d4b3c00 10.10.40.254#40246 (acb.netgate.com.foo.org): query: acb.netgate.com.foo.org IN SRV +E(0)D (10.10.40.22)

      It appened my domain name (redacted to "foo.org") to the FQDN.
      In System / General Setup I do the domain configured.

      A re-query for either ews.netgate.com or acb.netgate.com does not find anything.

      Naturally the resolver returns NXDOMAIN for both.
      Though if Netgate is expecting this to resolve it should probably be fixed.

      Is there a misconfiguration on my end that should be resolved?
      Is this a known issue?

      -- Best regards.

      GertjanG johnpozJ D 3 Replies Last reply Reply Quote 0
      • GertjanG Offline
        Gertjan @dono
        last edited by Gertjan

        @dono said in Domain being appended to ews.netgate.com and acb.netgate.com queries:

        A re-query for either ews.netgate.com or acb.netgate.com does not find anything.

        From any pfSense LAN device : edit : not any, mine :

        C:\Users\Gauche>nslookup acb.netgate.com
Serveur :   pfSense.bhf.tld
Address:  2a01:cb19:dead:beef:92ec:77ff:fe29:392c

Réponse ne faisant pas autorité :
Nom :    acb.netgate.com
Address:  208.123.73.69

C:\Users\Gauche>nslookup ews.netgate.com
Serveur :   pfSense.bhf.tld
Address:  2a01:cb19:dead:beef:92ec:77ff:fe29:392c

Réponse ne faisant pas autorité :
Nom :    ews.netgate.com
Addresses:  2610:160:11:11::69
          208.123.73.69

        Btw : The "2a01:cb19:dead:beef:92ec:77ff:fe29:392c" is my pfSense IPv6 LAN IPv6.
        I can also use the good old (legacy) Ipv4 : 192.168.1.1 - or whatever your pfSense LAN IPv4 is.

        @dono said in Domain being appended to ews.netgate.com and acb.netgate.com queries:

        Is there a misconfiguration on my end that should be resolved?

        Most probably, yes.

        @dono said in Domain being appended to ews.netgate.com and acb.netgate.com queries:

        Is this a known issue?

        Yes. People love to break DNS ^^

        @dono said in Domain being appended to ews.netgate.com and acb.netgate.com queries:

        Naturally the resolver returns NXDOMAIN for both.

        NXDOMAIN ? Both domains really exist.
        pfSense doesn't talk a lot to the outside, but "acb.netgate.com" is used for :

        270e8577-c884-4db7-8da5-52edbec7545d-image.png

        ( if you have set it up )

        No "help me" PM's please. Use the forum, the community will thank you.

        D 1 Reply Last reply Reply Quote 0
        • johnpozJ Offline
          johnpoz LAYER 8 Global Moderator @dono
          last edited by johnpoz

          @dono said in Domain being appended to ews.netgate.com and acb.netgate.com queries:

          Is there a misconfiguration on my end that should be resolved?

          No normally a dns client with a search suffix will query with the search suffix added.

          But you should see both queries in the logs

          Jun 22 06:56:56 	unbound 	65415 	[65415:3] info: 127.0.0.1 ews.netgate.com.home.arpa. SRV IN NXDOMAIN 0.000000 1 43
Jun 22 06:56:56 	unbound 	65415 	[65415:3] info: 127.0.0.1 ews.netgate.com.home.arpa. SRV IN
Jun 22 06:56:56 	unbound 	65415 	[65415:3] info: 127.0.0.1 ews.netgate.com. SRV IN NOERROR 0.027745 0 79
Jun 22 06:56:56 	unbound 	65415 	[65415:3] info: 127.0.0.1 ews.netgate.com. SRV IN

          Are you only logging failures? your saying if you query ews.netgate.com you get no answer?

          [26.03.1-RELEASE][admin@sg4860.home.arpa]/root: dig ews.netgate.com

; <<>> DiG 9.20.18 <<>> ews.netgate.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18190
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;ews.netgate.com.               IN      A

;; ANSWER SECTION:
ews.netgate.com.        1780    IN      A       208.123.73.69

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Mon Jun 22 07:27:15 CDT 2026
;; MSG SIZE  rcvd: 60

          Are those 10.10.40.21 and .22 the answers? Or you running bind on those IPs, and are pointing pfsense to those IPs for dns?

          But it is common for a dns client to do queries with the search suffix, look in your resolv.conf on pfsense and you will see your domain listed as search

          [26.03.1-RELEASE][admin@sg4860.home.arpa]/root: cat /etc/resolv.conf 
nameserver 127.0.0.1
search home.arpa
[26.03.1-RELEASE][admin@sg4860.home.arpa]/root:

          Not sure about SRV query - I show nothing back for a SRV query for either of those FQDN other than an SOA.. I do believe pfsense uses some SRV records, not sure off top of the head are either of these. But a query for both of those fqdn gets back no SRV.. Not sure why pfsense on its own would ask for those, if its not actively being used..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 26.03.1 | Lab VMs 2.8.1, 26.03.1

          D 1 Reply Last reply Reply Quote 0
          • D Offline
            dono @Gertjan
            last edited by

            @Gertjan

            A re-query for either ews.netgate.com or acb.netgate.com does not find anything.

            From any pfSense LAN device : edit : not any, mine :

            Apologies if I was not clear. Of course nslookup from any client resolves these subdomains. I was referring to the query logs on the DNS resolvers. Sometimes when a host does not know the FQDN it will send multiple queries, a bare hostname followed by another appending known domain(s) until one resolves. So while ews.netgate.com.foo.org and acb.netgate.com.foo.org failed I wouldn't have been surprised to find follow queries to ews.netgate.com and acb.netgate.com in the query logs. However, they were not there.

            NXDOMAIN ? Both domains really exist.

            Apologies if I was not clear. ews.netgate.com.foo.org and acb.netgate.com.foo.org naturally return NXDOMAIN as expected.
            ews.netgate.com and acb.netgate.com resolve just fine.

            Yes, Auto Configuration Backup is up and running. I have verified that the backups are good.

            -- Best regards

            1 Reply Last reply Reply Quote 0
            • D Offline
              dono @johnpoz
              last edited by

              @johnpoz

              Are you only logging failures? your saying if you query ews.netgate.com you get no answer?

              All queries are logged, not only failures. ews.netgate.com resolves just fine, if I do it manually. The queries coming from pfSense only tried to resolve ews.netgate.com.foo.org, not ews.netgate.com.

              Are those 10.10.40.21 and .22 the answers? Or you running bind on those IPs, and are pointing pfsense to those IPs for dns?

              10.10.40.21 and 10.10.40.22 are the BIND servers. pfSense uses them for name resolution.

              But it is common for a dns client to do queries with the search suffix, look in your resolv.conf on pfsense and you will see your domain listed as search

              Yes, /etc/resolv.conf shows the expected domain name. (What I am calling "foo.org" here.)

              -- Best regards

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ Offline
                johnpoz LAYER 8 Global Moderator @dono
                last edited by

                @dono said in Domain being appended to ews.netgate.com and acb.netgate.com queries:

                ews.netgate.com resolves just fine, if I do it manually.

                A record sure, but not a SRV record - I show no IP returned for that sort of record with that specific fqdn. It is pretty much a given that record with your search suffix on it should return NX. Unless you were doing like a wild card in your local NS handing foo.org

                It shouldn't be an issue asking for wrong fqdn and service type actually, with and without suffix added. But it is odd in general that asking for a SRV, if there is no SRV record type.. Maybe they are changing how something is being done. Maybe they just cover the bases and do queries for multiple record types. I am not a fan how dns clients append suffix as well - its just queries that shouldn't have to be done. One or two clients doing it wouldn't be a big deal, but if your talking 100's or even 1000s or 10s of 1000s - yeah it can add up to a bunch resources asking for stuff that doesn't exist and would never resolve ever.

                Clients that ask for AAAA when they have no viable IPv6 address, even if you remove their ipv6 link-local address.. WTF are you asking for AAAA ;)

                It is possible that reason your not seeing query for non suffix fqdn, is that was cached locally on pfsense.. So there was no need to ask your bind servers for that record.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 26.03.1 | Lab VMs 2.8.1, 26.03.1

                1 Reply Last reply Reply Quote 0
                • D Offline
                  dono @dono
                  last edited by dono

                  I think I tracked it down. The SRV query appears to belong to the repository agent (pfSense-repoc). It's trying to find the closest or most available update mirror.

                  I ran the following:

                  pkg -d update

                  The results showed pfSense stuck in a loop checking for system updates. Netgate's repository servers (pfsense-plus-pkg01 and pkg00) were actively rejecting your firewall's built-in client certificate at the application layer, throwing an HTTP 400 Bad Request.

                  Because of this failure, the pkg tool mistakenly attempted to resume partial downloads using bad byte ranges, causing it to endlessly cycle between mirrors and throw erratic errors. Additionally, this update routine caused the firewall to query netgate.com as a relative name, resulting in the netgate.com.foo.org that I saw in the BIND logs.

                  I resolved this as follows:

                  rm -rf /var/db/pkg/repos/*

                  Wipe out the corrupted metadata cache and clear the broken partial download states that were driving the infinite loop.

                  pfSense-upgrade -cc

                  Clean the internal upgrade utility cache. This forced the firewall to dump the stale SSL session tokens and request a fresh mutual TLS (mTLS) authentication challenge from Netgate's registration backend.

                  -- Best regards

                  1 Reply Last reply Reply Quote 2
                  • First post
                    Last post
                  Copyright 2026 Rubicon Communications LLC (Netgate). All rights reserved.