Intermittent NXDOMAIN and NOERROR without ANSWER being turned #1033
Assignees
Comments
|
Unbound usually does not alter answers from upstream. After some initial security scrubbing (removing irrelevant or poisonous records) there are some options that could remove RRSETs from a response (like The first log output is not very helpful as it is for the The second log output is interesting as it shows a reply from root ( this indicates that probably there is something between Unbound and the Internet interacting with DNS traffic. |
|
Potentially for the first log I grapped the wrong snippet. Could have been from when I was trying to work around. In the below there are entries for I don't have anything knowingly on my side that could be interacting with DNS traffic. It seems a bit weird to say that it could be my ISP doing things though. I'm with probably the largest ISP in the UK, and have been having this issue intermittently for the last week. While this is just an example domain, I have been getting this errors all over the place on some domains (i.e. facebook.com, hub.docker.com), and until Unbound is restarted I just get the above errors. Weirdly restarting Unbound seems to resolve the issue for a few minutes each time, before it then proceeds to just not return anything again. Also find it weird that pointing to just public DNS servers seems to resolve the issue, as everything loads without a problem then. At this point its just bugging me not knowing what is causing the problem. When so many other people seem to use Unbound without any problem at all. |
|
I'll take an example from your log: This is what Unbound gets as a UDP answer from "what seems to be" 192.36.148.17; which is supposed to be i.root-servers.net. (there was also scrubbing of Below is a normal answer for the same query directly to i.root-servers.net: This is the correct answer where the root server provides a NOERROR data together with the delegation information for "pl.". For using open resolvers; maybe you are using stateful transports to them (e.g., TCP/TLS) or this interaction has exceptions for well-known open resolvers. You can try something like the following in your Unbound config file to see if forwarding everything to open resolvers solves the issue for you while using Unbound for local validation: You can also take this a step further and use DoT (DNS over TLS) with those open resolvers (https://dnsprivacy.org/public_resolvers/#dns-over-tls-dot). For more information you can have a look at https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#forward-zone-options As a side note: I vaguely remember seeing something similar from another user and a UK ISP but I can't seem to find the issue at the moment. |
|
Just found the other issue I referred to. Are you using SKY in the UK per chance? |
|
In regards to the Sky question, I am using BT, however they both make use of the same fibre under the hood and are both managed by OpenReach, to now sure if there could be overlap there. Weirdly on my host machine I see the following: but running off the machine pihole / unbound are running on: Not sure why it would be getting two different responses. |
|
So this doesn't seem like an Unbound issue. |
|
Here are the output for both. Host machine running Ubuntu (actually in WSL2) The then the second device, running Raspbian and where pihole and unbound are: I just don't see why these overall issue Manifests when using Unbound, as I don't have any other issues otherwise. |
|
If you configure your pihole to not use Unbound, would the last two In that case this seems to be an issue related to your pihole; not a pihole issue per se.
For now this seems like a configuration issue with pihole. I would suggest to also reach out to that community for helpful pointers. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
Frequently I am getting NOERRORS without ANSWERs being returned for known working domains.
To reproduce
Steps to reproduce the behavior:
dig rexia.pl @10.44.3.2 -p 53
Getting NORROR returned without an ANSWER.
10.44.3.2 is my pihole DNS server which is using Unbound to resolve DNS queries.
I have also been getting NXDOMAINs errors returned as well, and these errors both manifest themselves as NXDOMAIN when viewing via Chrome.
dig otclient.ovh @10.44.3.2 -p 53
Expected behaviour
When switching over to public DNS servers, i.e. Cloudfare, Quad9, I correctly get an ANSWER back:
This also seems to respond correct intermittently when using Unbound as the upstream DNS.
I'm not sure if there is something wrong I'm doing here but any help would really be appreciated. Even though I having just given one domain here, I have been having similar issues with facebook.com, hub.docker.com, and numerous other domains since adopting unbound.
System:
unbound -Voutput:Version 1.19.3
Configure line:
Linked libs: mini-event internal (it uses select), OpenSSL 1.1.1w 11 Sep 2023
Linked modules: dns64 respip validator iterator
BSD licensed, see LICENSE in source package for details.
Report bugs to [email protected] or https://github.com/NLnetLabs/unbound/issues
Additional information
Add any other information that you may have gathered about the issue here.
My unbound configuration:
The text was updated successfully, but these errors were encountered: