Weird DNS forwarder issue for certain DNS names

[keyser]

Hi.

I'm seeing a strange issue using my DNS forwarder on 2.2.1. It works as expected for almost everything.
But if i lookup outlook.office365.com from a windows client, it will hang for approx. 20 sec. and then return with: unspecified error
If I do the same lookup from a linux, i get a "Truncated - retrying in TCP mode" which fails.

When using another internal dns server (windows) from the above clients, the names resolves correctly.
Doing a lookup of the name using the PFsense GUI i get a valid reponse.

So it's something the DNS forwarder does with the response to the clients. Any ideas?

[keyser]

After a lot of troubleshooting I had to give up and configure the new resolver instead (Something i was planning to do anyways).

The new resolver does not exibit the problem

[johnpoz]

Where were you forwarding too?

[keyser]

My ISP's DNS servers. When using them directly with nslookup Everything works as expected.
So as far as I can tell the forwarder was the culprit.

[johnpoz]

I don't use the forwarder since 2.2 and resolver became standard.  Do you have the resolver in forwarder mode or true resolver?

[keyser]

I decided on true resolver mode.

[keyser]

FYI:

I have the exact same problem with the forwarder on a PFsense 2.1.5 install I have. So i'm now certain it's a forwarder issue.

[johnpoz]

I doubt its a forwarder issue, more like an issue to where our forwarding too and whatever domain is in question, etc.. without any exact info its hard to test to see what the actual problem might be.

[keyser]

Found the issue. It was actually my ISP's DNS caching server (or more specifically - one of them) that caused the issue. Every time my forwarder hit that specific DNS server for resolution the issue occured…

So PFsense's forwarder is working as expected.

[doktornotor]

Yeah, sadly the state of things appears to be such that it's generally best to avoid and ISP-provided DNS servers altogether. Broken, slow, badly maintained, not supporting DNSSEC, used for internet censorship. Sigh…  >:(

[bennymundz]

@doktornotor:

Yeah, sadly the state of things appears to be such that it's generally best to avoid and ISP-provided DNS servers altogether. Broken, slow, badly maintained, not supporting DNSSEC, used for internet censorship. Sigh…  >:(

What dns servers do you suggest then ?

[cmb]

@bennymundz:

What dns servers do you suggest then ?

Do your own recursion, or Google's public DNS is probably the least-bad of the other options.

[johnpoz]

I don't understand why you don't just resolve yourself as well.. This is I believe the new default in pfsense.. If you have issues with that, then use say level3 open - 4.2.2.2 is one I always used..

Comcast dns use to be horrific, its has gotten better over the years.  But I like doing my own recursion so have full support of dnssec for sure, etc.