Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Weird DNS forwarder issue for certain DNS names

    DHCP and DNS
    5
    13
    1256
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      keyser last edited by

      Hi.

      I'm seeing a strange issue using my DNS forwarder on 2.2.1. It works as expected for almost everything.
      But if i lookup outlook.office365.com from a windows client, it will hang for approx. 20 sec. and then return with: unspecified error
      If I do the same lookup from a linux, i get a "Truncated - retrying in TCP mode" which fails.

      When using another internal dns server (windows) from the above clients, the names resolves correctly.
      Doing a lookup of the name using the PFsense GUI i get a valid reponse.

      So it's something the DNS forwarder does with the response to the clients. Any ideas?

      1 Reply Last reply Reply Quote 0
      • K
        keyser last edited by

        After a lot of troubleshooting I had to give up and configure the new resolver instead (Something i was planning to do anyways).

        The new resolver does not exibit the problem

        1 Reply Last reply Reply Quote 0
        • johnpoz
          johnpoz LAYER 8 Global Moderator last edited by

          Where were you forwarding too?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

          1 Reply Last reply Reply Quote 0
          • K
            keyser last edited by

            My ISP's DNS servers. When using them directly with nslookup Everything works as expected.
            So as far as I can tell the forwarder was the culprit.

            1 Reply Last reply Reply Quote 0
            • johnpoz
              johnpoz LAYER 8 Global Moderator last edited by

              I don't use the forwarder since 2.2 and resolver became standard.  Do you have the resolver in forwarder mode or true resolver?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

              1 Reply Last reply Reply Quote 0
              • K
                keyser last edited by

                I decided on true resolver mode.

                1 Reply Last reply Reply Quote 0
                • K
                  keyser last edited by

                  FYI:

                  I have the exact same problem with the forwarder on a PFsense 2.1.5 install I have. So i'm now certain it's a forwarder issue.

                  1 Reply Last reply Reply Quote 0
                  • johnpoz
                    johnpoz LAYER 8 Global Moderator last edited by

                    I doubt its a forwarder issue, more like an issue to where our forwarding too and whatever domain is in question, etc.. without any exact info its hard to test to see what the actual problem might be.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                    1 Reply Last reply Reply Quote 0
                    • K
                      keyser last edited by

                      Found the issue. It was actually my ISP's DNS caching server (or more specifically - one of them) that caused the issue. Every time my forwarder hit that specific DNS server for resolution the issue occured…

                      So PFsense's forwarder is working as expected.

                      1 Reply Last reply Reply Quote 0
                      • D
                        doktornotor Banned last edited by

                        Yeah, sadly the state of things appears to be such that it's generally best to avoid and ISP-provided DNS servers altogether. Broken, slow, badly maintained, not supporting DNSSEC, used for internet censorship. Sigh…  >:(

                        1 Reply Last reply Reply Quote 0
                        • B
                          bennymundz last edited by

                          @doktornotor:

                          Yeah, sadly the state of things appears to be such that it's generally best to avoid and ISP-provided DNS servers altogether. Broken, slow, badly maintained, not supporting DNSSEC, used for internet censorship. Sigh…  >:(

                          What dns servers do you suggest then ?

                          1 Reply Last reply Reply Quote 0
                          • C
                            cmb last edited by

                            @bennymundz:

                            What dns servers do you suggest then ?

                            Do your own recursion, or Google's public DNS is probably the least-bad of the other options.

                            1 Reply Last reply Reply Quote 0
                            • johnpoz
                              johnpoz LAYER 8 Global Moderator last edited by

                              I don't understand why you don't just resolve yourself as well.. This is I believe the new default in pfsense.. If you have issues with that, then use say level3 open - 4.2.2.2 is one I always used..

                              Comcast dns use to be horrific, its has gotten better over the years.  But I like doing my own recursion so have full support of dnssec for sure, etc.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              2440 2.4.5p1 | 2x 3100 2.4.4p3 | 2x 3100 22.01 | 4860 22.05

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post