Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Weird DNS forwarder issue for certain DNS names

    Scheduled Pinned Locked Moved DHCP and DNS
    13 Posts 5 Posters 1.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • keyserK
      keyser Rebel Alliance
      last edited by

      Hi.

      I'm seeing a strange issue using my DNS forwarder on 2.2.1. It works as expected for almost everything.
      But if i lookup outlook.office365.com from a windows client, it will hang for approx. 20 sec. and then return with: unspecified error
      If I do the same lookup from a linux, i get a "Truncated - retrying in TCP mode" which fails.

      When using another internal dns server (windows) from the above clients, the names resolves correctly.
      Doing a lookup of the name using the PFsense GUI i get a valid reponse.

      So it's something the DNS forwarder does with the response to the clients. Any ideas?

      Love the no fuss of using the official appliances :-)

      1 Reply Last reply Reply Quote 0
      • keyserK
        keyser Rebel Alliance
        last edited by

        After a lot of troubleshooting I had to give up and configure the new resolver instead (Something i was planning to do anyways).

        The new resolver does not exibit the problem

        Love the no fuss of using the official appliances :-)

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          Where were you forwarding too?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • keyserK
            keyser Rebel Alliance
            last edited by

            My ISP's DNS servers. When using them directly with nslookup Everything works as expected.
            So as far as I can tell the forwarder was the culprit.

            Love the no fuss of using the official appliances :-)

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by

              I don't use the forwarder since 2.2 and resolver became standard.  Do you have the resolver in forwarder mode or true resolver?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • keyserK
                keyser Rebel Alliance
                last edited by

                I decided on true resolver mode.

                Love the no fuss of using the official appliances :-)

                1 Reply Last reply Reply Quote 0
                • keyserK
                  keyser Rebel Alliance
                  last edited by

                  FYI:

                  I have the exact same problem with the forwarder on a PFsense 2.1.5 install I have. So i'm now certain it's a forwarder issue.

                  Love the no fuss of using the official appliances :-)

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    I doubt its a forwarder issue, more like an issue to where our forwarding too and whatever domain is in question, etc.. without any exact info its hard to test to see what the actual problem might be.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • keyserK
                      keyser Rebel Alliance
                      last edited by

                      Found the issue. It was actually my ISP's DNS caching server (or more specifically - one of them) that caused the issue. Every time my forwarder hit that specific DNS server for resolution the issue occured…

                      So PFsense's forwarder is working as expected.

                      Love the no fuss of using the official appliances :-)

                      1 Reply Last reply Reply Quote 0
                      • D
                        doktornotor Banned
                        last edited by

                        Yeah, sadly the state of things appears to be such that it's generally best to avoid and ISP-provided DNS servers altogether. Broken, slow, badly maintained, not supporting DNSSEC, used for internet censorship. Sigh…  >:(

                        1 Reply Last reply Reply Quote 0
                        • B
                          bennymundz
                          last edited by

                          @doktornotor:

                          Yeah, sadly the state of things appears to be such that it's generally best to avoid and ISP-provided DNS servers altogether. Broken, slow, badly maintained, not supporting DNSSEC, used for internet censorship. Sigh…  >:(

                          What dns servers do you suggest then ?

                          1 Reply Last reply Reply Quote 0
                          • C
                            cmb
                            last edited by

                            @bennymundz:

                            What dns servers do you suggest then ?

                            Do your own recursion, or Google's public DNS is probably the least-bad of the other options.

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by

                              I don't understand why you don't just resolve yourself as well.. This is I believe the new default in pfsense.. If you have issues with that, then use say level3 open - 4.2.2.2 is one I always used..

                              Comcast dns use to be horrific, its has gotten better over the years.  But I like doing my own recursion so have full support of dnssec for sure, etc.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.