"Maximum number of concurrent DNS queries" with strange lb._dns-sd._udp. ... .in-addr.arpa reverse DNS queries (has Pi running Adguard Home + Unbound)

[loveleeyoungae]

Hi,

My internet line has been stuttered and intermittent for some weeks. Last night, I took some time to check.
1. First, my setup:
192.168.7.1: an AC68U with Merlin firmware
192.168.7.110: a Pi running Adguard Home + Unbound only acts as DNS server
Both WAN and LAN DNS servers settings on the router are set to point only to the Pi's IP address
Adguard Home settings:

Spoiler

2.
a. In the router, the syslog was flooded with the error: "dnsmasq[254]: Maximum number of concurrent DNS queries reached (max: 150)"
b. googled around for the error, saw suggestions to run the tcpdump command, here is a part of the result:

16:21:34.179847 vlan1 In  IP 192.168.7.110.53 > 192.168.7.1.16005: 62299 ServFail 0/0/0 (60)
16:21:34.179847 br0   In  IP 192.168.7.110.53 > 192.168.7.1.16005: 62299 ServFail 0/0/0 (60)
16:21:34.181195 br0   Out IP 192.168.7.1.16005 > 192.168.7.110.53: 51220+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.181237 vlan1 Out IP 192.168.7.1.16005 > 192.168.7.110.53: 51220+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.181513 vlan1 In  IP 192.168.7.110.53 > 192.168.7.1.40239: 44526 ServFail 0/0/0 (60)
16:21:34.181513 br0   In  IP 192.168.7.110.53 > 192.168.7.1.40239: 44526 ServFail 0/0/0 (60)
16:21:34.182162 br0   Out IP 192.168.7.1.29256 > 192.168.7.110.53: 1291+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.182199 vlan1 Out IP 192.168.7.1.29256 > 192.168.7.110.53: 1291+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.182716 br0   Out IP 192.168.7.1.16005 > 192.168.7.110.53: 14266+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.182755 vlan1 Out IP 192.168.7.1.16005 > 192.168.7.110.53: 14266+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.182934 br0   Out IP 192.168.7.1.40239 > 192.168.7.110.53: 44526+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.182961 vlan1 Out IP 192.168.7.1.40239 > 192.168.7.110.53: 44526+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.183038 vlan1 In  IP 192.168.7.110.54932 > 192.168.7.1.53: 17048+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.183038 br0   In  IP 192.168.7.110.54932 > 192.168.7.1.53: 17048+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.183733 br0   Out IP 192.168.7.1.34857 > 192.168.7.110.53: 28070+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.183770 vlan1 Out IP 192.168.7.1.34857 > 192.168.7.110.53: 28070+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.184159 br0   Out IP 192.168.7.1.16005 > 192.168.7.110.53: 26436+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.184193 vlan1 Out IP 192.168.7.1.16005 > 192.168.7.110.53: 26436+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.184525 vlan1 In  IP 192.168.7.110.53 > 192.168.7.1.47843: 3898 ServFail 0/0/0 (60)
16:21:34.184525 br0   In  IP 192.168.7.110.53 > 192.168.7.1.47843: 3898 ServFail 0/0/0 (60)
16:21:34.184719 vlan1 In  IP 192.168.7.110.53 > 192.168.7.1.51517: 25900 ServFail 0/0/0 (60)
16:21:34.184719 br0   In  IP 192.168.7.110.53 > 192.168.7.1.51517: 25900 ServFail 0/0/0 (60)
16:21:34.184826 vlan1 In  IP 192.168.7.110.53 > 192.168.7.1.4832: 47891 ServFail 0/0/0 (60)
16:21:34.184826 br0   In  IP 192.168.7.110.53 > 192.168.7.1.4832: 47891 ServFail 0/0/0 (60)
16:21:34.185598 br0   Out IP 192.168.7.1.36266 > 192.168.7.110.53: 10075+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.185637 vlan1 Out IP 192.168.7.1.36266 > 192.168.7.110.53: 10075+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.185783 vlan1 In  IP 192.168.7.110.57634 > 192.168.7.1.53: 14266+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.185783 br0   In  IP 192.168.7.110.57634 > 192.168.7.1.53: 14266+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.185791 vlan1 In  IP 192.168.7.110.34812 > 192.168.7.1.53: 22028+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.185791 br0   In  IP 192.168.7.110.34812 > 192.168.7.1.53: 22028+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.186084 vlan1 In  IP 192.168.7.110.44716 > 192.168.7.1.53: 1291+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.186084 br0   In  IP 192.168.7.110.44716 > 192.168.7.1.53: 1291+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.186420 br0   Out IP 192.168.7.1.16005 > 192.168.7.110.53: 30958+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.186681 br0   Out IP 192.168.7.1.47843 > 192.168.7.110.53: 3898+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.187035 br0   Out IP 192.168.7.1.51517 > 192.168.7.110.53: 25900+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)
16:21:34.187068 vlan1 Out IP 192.168.7.1.51517 > 192.168.7.110.53: 25900+ PTR? lb._dns-sd._udp.157.40.235.10.in-addr.arpa. (60)

c. googled around for the "lb._dns-sd..." stuff, and realized that there might be some differences for my situation:
- in other reports:
+ the reversed IP in the "lb._dns-sd._udp.*.*.*.*.in-addr.arpa" query are usually "0.0.168.192" and issues are usually caused by Apple devices/ Bonjour services, DNS Discovery etc,
+ IIRC, a comment suggested that if the ISP internet connection itself is bad, unbound might have unstable connection to root servers and might cause the issue (unfortunately I didn't know if I read correctly, and couldn't remember which link has that comment among 50-ish links I googled)
- in my system:
+ the reversed IP on my system is "157.40.23.10" and my system doesn't have any "10.x.x.x" subnet
+ I have some iPhones, iPads, and icloud/ iTunes installed on some computers, I tried disconnecting them all from network but the dnsmasq errors were still there


d. Guessed I might need to see more detailed logs:
- AGH: didn't see any strange queries
- unbound: tried to enable log using this guide but unsuccessful (apparmor_parser step). Looking at the Pi's syslog only has several lines related to unbound.

Haven't tried setting dnsmasq max connection to 1024 or disabling "Use private reverse DNS resolvers" setting in AGH, but even though those help, obviously the uneasy feeling is still there when we know that something is flooding the DNS queries. So if anyone has any idea on what the issue might be related to, how to fix it etc., please help me.

Thanks in advance.