RT-AC86U intermittent DNS_PROBE_FINISHED_NXDOMAIN

[Zastoff]

If i remember correctly (not sure)
Only time i experienced the "DNS_PROBE_FINISHED_NXDOMAIN"
Was on clients that did not have intranet access(guest network on a ac87u), Did tests with dnscrypt-proxy v2 and the in gui DoT and got this error randomly, Different servers did not matter.
Now i use servers via dns-filter for clients that use the guest network.
Don't know if this is related at all..

 

[BlN4RY]

@Cornel @ColinTaylor Disconnected all LAN devices, and set it up again from scratch with a nuclear reset. Enabled options step by step and tested. The NXDomain error is only happening when AICloud is enabled.

This issue is present even on 386.2_4.

Can anyone else try to see if they can replicate the issue?

 

[Cornel]

@Cornel @ColinTaylor Disconnected all LAN devices, and set it up again from scratch with a nuclear reset. Enabled options step by step and tested. The NXDomain error is only happening when AICloud is enabled.

This issue is present even on 386.2_4.

Can anyone else try to see if they can replicate the issue?

I'm not using AiCloud

 

[sbsnb]

Maybe this isn't a local problem or a DNS issue, but a problem with your ISP's network generally. Can you setup a continuous ping to somewhere like www.google.com and see if you loose all internet connectivity?

It's not a connectivity issue. It just manifests intermittently. I've seen it happen to common domains like google that were accessed successfully less than a minute prior, which leads me to believe there's some caching issue with dnsmasq. Looking up a different domain usually works, and domains already cached locally on the client work fine.

 

[ColinTaylor]

It's not a connectivity issue. It just manifests intermittently when a domain isn't already cached on the client machine. I've seen it happen to common domains like google that were accessed successfully less than a minute prior, which leads me to believe there's some caching issue with dnsmasq. Looking up a different domain usually works, and domains already cached locally on the client work fine.

I can't say that I remember ever seeing this exact error message in all the years and various versions of dnsmasq. But then I run vanilla DNS without anything like DNSSEC, DoT, DNSCrypt, etc.

 

[john9527]

I can't say that I remember ever seeing this exact error message in all the years and various versions of dnsmasq. But then I run vanilla DNS without anything like DNSSEC, DoT, DNSCrypt, etc.

First (and only) time I saw it was this past Monday (5/3) when Quad9 was having its problems (was using Quad9, DNSSEC, DoT)

 

[ColinTaylor]

First (and only) time I saw it was this past Monday (5/3) when Quad9 was having its problems (was using Quad9, DNSSEC, DoT)

OK this is weird. When I tested this before (by typing in garbage domain names) I was getting "ERR_NAME_NOT_RESOLVED" even though I verified that dnsmasq was returning NXDOMAIN. Now when I do this same thing I get "DNS_PROBE_FINISHED_NXDOMAIN". The only differnce I can think of is the updated firmware. @john9527 ? I really wish Google would document the exact meaning of all these similar error messages.

 

[john9527]

When I tested this before (by typing in garbage domain names) I was getting "ERR_NAME_NOT_RESOLVED"

I just tried a few 'garbage' names and still get "ERR_NAME_NOT_RESOLVED"... I'm stumped.

 

[ColinTaylor]

I just tried a few 'garbage' names and still get "ERR_NAME_NOT_RESOLVED"... I'm stumped.

Just rolled back to the previous firmware (flushed caches, etc.) and still getting "DNS_PROBE_FINISHED_NXDOMAIN".

 

[john9527]

Just rolled back to the previous firmware (flushed caches, etc.) and still getting "DNS_PROBE_FINISHED_NXDOMAIN".

Which upstream DNS are you using?

 

[ColinTaylor]

Which upstream DNS are you using?

I've tried all combinations of what I've used in the past, which would be my ISP's and/or 9.9.9.9.

 

[john9527]

I've tried all combinations of what I've used in the past, which would be my ISP's and/or 9.9.9.9.

Tried different DNS servers, DoT ON/OFF, DNSSEC ON/OFF.....all I see is ERR_NAME_NOT_RESOLVED

 

[ColinTaylor]

Tried different DNS servers, DoT ON/OFF, DNSSEC ON/OFF.....all I see is ERR_NAME_NOT_RESOLVED

What browser version are you using?

 

[john9527]

What browser version are you using?

Linux - Chrome 90.0.4430.93-1

 

[ColinTaylor]

Linux - Chrome 90.0.4430.93-1

Same here but for Windows. I even reinstalled version 80.0 but I'm still not seeing that "old" error message.

 

[BlN4RY]

It's not a connectivity issue. It just manifests intermittently. I've seen it happen to common domains like google that were accessed successfully less than a minute prior, which leads me to believe there's some caching issue with dnsmasq. Looking up a different domain usually works, and domains already cached locally on the client work fine.

Yep. The exact same thing was happening to me. Have not had a single false NXDOMAIN since I disabled AiCloud. Did you start seeing the issue around the 386.1_2 update (Feb 2021)? Also, do you have AiCloud enabled?

 

[BlN4RY]

OK this is weird. When I tested this before (by typing in garbage domain names) I was getting "ERR_NAME_NOT_RESOLVED" even though I verified that dnsmasq was returning NXDOMAIN. Now when I do this same thing I get "DNS_PROBE_FINISHED_NXDOMAIN". The only differnce I can think of is the updated firmware. @john9527 ? I really wish Google would document the exact meaning of all these similar error messages.

Tried accessing garbage domains on my phone's Chrome browser on WiFi and mobile data. Getting a DNS_PROBE_FINISHED_NXDOMAIN on both occasions. Chrome on Windows 10 gives the same error on WiFi.

 

[ColinTaylor]

Yep. The exact same thing was happening to me. Have not had a single false NXDOMAIN since I disabled AiCloud. Did you start seeing the issue around the 386.1_2 update (Feb 2021)? Also, do you have AiCloud enabled?

Do you mean AiCloud or AiProtection?

 

[BlN4RY]

Do you mean AiCloud or AiProtection?

AiCloud. Was using the cloud disk feature for file sharing.

 

[sbsnb]

I do not use any of the opt-in features. I've had this DNS issue for years. It's only rarely intermittent. I'd say I see it once every two weeks or so, and it only last for a few seconds.