Router performing crippling "DNSKEY" look-ups out of the blue

[CB7]

Hi,

Sometimes, out of nowhere as I really cannot put a clock or any preceding event to it, the router suddenly starts sending out thousands of queries for "." (without quotes, so literally just a dot).
The type is "DNSKEY, plain DNS" and, probably due to the sheer volume of them (we're talking tens of thousands of requests suddenly), they take about 20 seconds to complete - each! The CPU load on the router skyrockets and DNS resolution comes to a halt (as well as services ceasing to respond).

... But why is it doing that? Digging deeeeep in my memory, I believe the . DNSKEY is to find root servers. But why on earth does it send tens of thousands of requests for it and all at once? It supposed to request it and then cache it for a while. Not try to resolve it thousands and thousands of time. To be clear: the requests come from the router itself, not from a client on the network.

Anyone got any idea? Google is not being overly helpful.
I'm running Merlin on an AX3000-V2 with AdGuard Home running as the DNS service. Attached some screenshots.

Thanks!

 

[dave14305]

Make sure DNSSEC is turned off on the WAN page. I can’t think of any other reason why the router would be making DNSKEY requests. Unless AdGuardHome is doing it to itself.

 

[CB7]

Make sure DNSSEC is turned off on the WAN page. I can’t think of any other reason why the router would be making DNSKEY requests. Unless AdGuardHome is doing it to itself.

Thanks - if that's the "Enable DNSSEC support" one you're referring to: that one is indeed already disabled. Right above that, I do have the DNS server set to the router itself (so AGH) - would it be better to change that to an external service? (I mean, it still shouldn't be sending tens of thousands of DNSKEY-requests; but at least it won't cripple itself over it.) I assume that won't affect DNS Director for all other clients on the network.

 

[dave14305]

What are the upstream servers for AGH? Maybe these queries are caught in a DNS loop.