Menu
What's new
By:
Filters Better Search

Unbound Unbound suddenly not resolving certian domains!

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

K

Khadanja

Senior Member
Everything was working fine until a day or two ago but now suddenly unbuond won't resolve this domain my.nest.gq. DNS is working fine as it works with VPN or if I use a different DNS server. 2nd Dig result is when using Cloudflare DNS. There is one more domain I'm having exactly same issue with. I'm not blocking any country in Skynet.
Code: 
; <<>> DiG 9.16.29 <<>> my.nest.gq
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 61048
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;my.nest.gq.                    IN      A
;; Query time: 2 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Wed Jul 20 10:52:52 New Zealand Standard Time 2022
;; MSG SIZE  rcvd: 39

Code: 
; <<>> DiG 9.18.1 <<>> my.nest.gq
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18636
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;my.nest.gq.                    IN      A
;; ANSWER SECTION:
my.nest.gq.             300     IN      A       172.67.134.106
my.nest.gq.             300     IN      A       104.21.25.172
;; Query time: 170 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Tue Jul 19 22:54:27 UTC 2022
;; MSG SIZE  rcvd: 71
 
Khadanja said:
Everything was working fine until a day or two ago but now suddenly unbuond won't resolve this domain my.nest.gq. DNS is working fine as it works with VPN or if I use a different DNS server. 2nd Dig result is when using Cloudflare DNS. There is one more domain I'm having exactly same issue with. I'm not blocking any country in Skynet.
Code: 
; <<>> DiG 9.16.29 <<>> my.nest.gq
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 61048
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;my.nest.gq.                    IN      A
;; Query time: 2 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Wed Jul 20 10:52:52 New Zealand Standard Time 2022
;; MSG SIZE  rcvd: 39

Code: 
; <<>> DiG 9.18.1 <<>> my.nest.gq
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18636
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;my.nest.gq.                    IN      A
;; ANSWER SECTION:
my.nest.gq.             300     IN      A       172.67.134.106
my.nest.gq.             300     IN      A       104.21.25.172
;; Query time: 170 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Tue Jul 19 22:54:27 UTC 2022
;; MSG SIZE  rcvd: 71
Click to expand...
Are you using DNSFirewall or Unbound adblock options?
 
Yes, I don't see any log relating to this getting blocked by DNS firewall or adblock though? Do you use unbound? Can you resolve it?
Jumpstarter said:
Are you using DNSFirewall or Unbound adblock options?
Click to expand...
 
Have you tried rebooting the router?

Is amtm, Unbound, and all other scripts (including Entware) fully updated?

Are you actually using firmware 386.3_2?

Any reason you're not using current firmware?
 
Khadanja said:
Yes, I don't see any log relating to this getting blocked by DNS firewall or adblock though? Do you use unbound? Can you resolve it?
Click to expand...
Yes
dig my.nest.gq

; <<>> DiG 9.16.27-Raspbian <<>> my.nest.gq
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22960
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;my.nest.gq. IN A

;; ANSWER SECTION:
my.nest.gq. 1200 IN A 172.67.134.106
my.nest.gq. 1200 IN A 104.21.25.172

;; Query time: 99 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Jul 19 19:02:28 EDT 2022
;; MSG SIZE rcvd: 71

However I don't use dnsfirewall or adblock features, also skynet has not blacklisted it for me either.
 
L&LD said:
Have you tried rebooting the router?

Is amtm, Unbound, and all other scripts (including Entware) fully updated?

Are you actually using firmware 386.3_2?

Any reason you're not using current firmware?
Click to expand...
Yes to all. Sorry forgot to update signature, using 386.7
If this helps - Jul 20 09:34:27 RT-AC68U-20E0 unbound: [3695:1] error: SERVFAIL <ad.nest.gq. A IN>: all servers for this domain failed, at zone gq. no server to query nameserver addresses not usable
 
Khadanja said:
Yes to all. Sorry forgot to update signature, using 386.7
If this helps - Jul 20 09:34:27 RT-AC68U-20E0 unbound: [3695:1] error: SERVFAIL <ad.nest.gq. A IN>: all servers for this domain failed, at zone gq. no server to query nameserver addresses not usable
Click to expand...
My first thought is your skynet or AI Protect may have somehow blacklisted it. I would whitelist it there first, then add it to any adblock whitelist you have.
 
Jumpstarter said:
My first thought is your skynet or AI Protect may have somehow blacklisted it. I would whitelist it there first, then add it to any adblock whitelist you have.
Click to expand...
tried whitelisting in skynet & unbound adblock, no luck
 
Did you reboot?
 
Khadanja said:
tried whitelisting in skynet & unbound adblock, no luck
Click to expand...
Keep in mind you may need to reboot everything like @L&LD suggest so that it refreshes everything, your unbound cache may also need to be cleared or you need to wait for the entries to expire before you notice any change especially if you are relying on unbound managers cache restoration on reboots.
 
ok will shut down everything for a while, router & modem both. One other subdomain was working until few minutes ago but now that also doesn't work.
 
Khadanja said:
ok will shut down everything for a while, router & modem both. One other subdomain was working until few minutes ago but now that also doesn't work.
Click to expand...
You may need to purge your unbound cache and start fresh. You could have some cache poisoning maybe?
 
Khadanja said:
Yes to all. Sorry forgot to update signature, using 386.7
If this helps - Jul 20 09:34:27 RT-AC68U-20E0 unbound: [3695:1] error: SERVFAIL <ad.nest.gq. A IN>: all servers for this domain failed, at zone gq. no server to query nameserver addresses not usable
Click to expand...
Try to ping any of these nameservers for gq (185.21…). I suspect they might be blocked by Skynet.
Code: 
# dig NS gq.

; <<>> DiG 9.18.1 <<>> NS gq.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60877
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 9

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 953ebfb937b9b4617ed2ab7762d73bf082f57b5536453cfb (good)
;; QUESTION SECTION:
;gq.                            IN      NS

;; ANSWER SECTION:
gq.                     10800   IN      NS      a.ns.gq.
gq.                     10800   IN      NS      d.ns.gq.
gq.                     10800   IN      NS      b.ns.gq.
gq.                     10800   IN      NS      c.ns.gq.

;; ADDITIONAL SECTION:
a.ns.gq.                28800   IN      A       185.21.168.65
b.ns.gq.                28800   IN      A       185.21.169.65
c.ns.gq.                28800   IN      A       185.21.170.65
d.ns.gq.                28800   IN      A       185.21.171.65
a.ns.gq.                28800   IN      AAAA    2a04:1b00:10::1
b.ns.gq.                28800   IN      AAAA    2a04:1b00:11::1
c.ns.gq.                28800   IN      AAAA    2a04:1b00:12::1
d.ns.gq.                28800   IN      AAAA    2a04:1b00:13::1
 
dave14305 said:
Try to ping any of these nameservers for gq (185.21…). I suspect they might be blocked by Skynet.
Code: 
# dig NS gq.

; <<>> DiG 9.18.1 <<>> NS gq.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60877
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 9

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 953ebfb937b9b4617ed2ab7762d73bf082f57b5536453cfb (good)
;; QUESTION SECTION:
;gq.                            IN      NS

;; ANSWER SECTION:
gq.                     10800   IN      NS      a.ns.gq.
gq.                     10800   IN      NS      d.ns.gq.
gq.                     10800   IN      NS      b.ns.gq.
gq.                     10800   IN      NS      c.ns.gq.

;; ADDITIONAL SECTION:
a.ns.gq.                28800   IN      A       185.21.168.65
b.ns.gq.                28800   IN      A       185.21.169.65
c.ns.gq.                28800   IN      A       185.21.170.65
d.ns.gq.                28800   IN      A       185.21.171.65
a.ns.gq.                28800   IN      AAAA    2a04:1b00:10::1
b.ns.gq.                28800   IN      AAAA    2a04:1b00:11::1
c.ns.gq.                28800   IN      AAAA    2a04:1b00:12::1
d.ns.gq.                28800   IN      AAAA    2a04:1b00:13::1
Click to expand...
I can ping all of them
 
I think something to do with timeout. https://www.nlnetlabs.nl/documentation/unbound/info-timeout/
github.com

Service Failed with 'timeout' · Issue #56 · NLnetLabs/unbound

I'm seeing serious issues with unbound where the service simply restarts itself intermittently. I say intermittently but I'm beginning to think it's related to the service failed timeout + the rest...
github.com github.com
Code: 
The following name servers are used for lookup of my.nest.gq.
;rrset 167531 4 0 10 0
gq.     167531  IN      NS      a.ns.gq.
gq.     167531  IN      NS      b.ns.gq.
gq.     167531  IN      NS      c.ns.gq.
gq.     167531  IN      NS      d.ns.gq.
;rrset 81131 1 1 10 0
gq.     81131   IN      NSEC    gr. NS RRSIG NSEC
gq.     81131   IN      RRSIG   NSEC 8 1 86400 20220801170000 20220719160000 20826 . kQDw63Ys3XeiWd8XHbW0qYJ67gKXFu6HZju82wavjAMER/fCh1cF+r88fCleAA5Sr3FpBES19HlZOFHX6Xpwxaa4OolfPcmz2qAFQIvQz22sjcxYUc7+YJdO7StoNXyMgGrAVb0aLyEyhpCMpAMsv6U}
;rrset 167531 1 0 10 0
d.ns.gq.        167531  IN      A       185.21.171.65
;rrset 167531 1 0 10 0
d.ns.gq.        167531  IN      AAAA    2a04:1b00:13::1
;rrset 167531 1 0 10 0
c.ns.gq.        167531  IN      A       185.21.170.65
;rrset 167531 1 0 10 0
c.ns.gq.        167531  IN      AAAA    2a04:1b00:12::1
;rrset 167531 1 0 10 0
b.ns.gq.        167531  IN      A       185.21.169.65
;rrset 167531 1 0 10 0
b.ns.gq.        167531  IN      AAAA    2a04:1b00:11::1
;rrset 167531 1 0 10 0
a.ns.gq.        167531  IN      A       185.21.168.65
;rrset 167531 1 0 10 0
a.ns.gq.        167531  IN      AAAA    2a04:1b00:10::1
Delegation with 4 names, of which 0 can be examined to query further addresses.
It provides 8 IP addresses.
2a04:1b00:10::1         not in infra cache.
185.21.168.65           not in infra cache.
2a04:1b00:11::1         not in infra cache.
185.21.169.65           rto 120000 msec, ttl 827, ping 0 var 94 rtt 376, tA 3, tAAAA 0, tother 3, probedelay 48, EDNS 0 assumed.
2a04:1b00:12::1         not in infra cache.
185.21.170.65           expired, rto 120000 msec, tA 3 tAAAA 0 tother 3.
2a04:1b00:13::1         not in infra cache.
185.21.171.65           expired, rto 120000 msec, tA 3 tAAAA 0 tother 0.
 
dave14305 said:
Try
Code: 
dig NS nest.gq. @185.21.168.65
Click to expand...
; <<>> DiG 9.16.29 <<>> NS nest.gq. @185.21.168.65
;; global options: +cmd
;; connection timed out; no servers could be reached
 
You must log in or register to reply here.

Similar threads

B
Unbound Test unbound
Replies
6
Views
959
Gary_Dexter
Gary_Dexter
pdc
Router DNS returning Refused
Replies
2
Views
574
pdc
pdc
M
Unbound Unable to make Unbound work
Replies
13
Views
1K
mangkoran
M
D
Unbound DNSSec with unbound_manager?
Replies
6
Views
2K
dominik
D
Don Walker
Unbound Unbound fails to resolve "epaper.ottawacitizen.com" with SERVFAIL
Replies
3
Views
2K
Don Walker
Don Walker
Similar threads
Thread starter Title Forum Replies Date
muffintastic Unbound Force all DNS requests through Unbound using iptables? Asuswrt-Merlin AddOns 14
Z Unbound Unbound + AdGuard Settings Asuswrt-Merlin AddOns 1
Z Unbound Unbound on subnet router Asuswrt-Merlin AddOns 3
B Unbound Does unbound update automatically? Asuswrt-Merlin AddOns 8
F Unbound Unbound stopped working Asuswrt-Merlin AddOns 3
B Unbound Unbound whitelist Asuswrt-Merlin AddOns 15
Jack-Sparr0w Is it possible to use nord dns with unbound or any way to add it? Asuswrt-Merlin AddOns 9
Jack-Sparr0w Guide to using vpn with unbound dns? Asuswrt-Merlin AddOns 3
B Unbound Use unbound/router as default DNS server Asuswrt-Merlin AddOns 2
B Unbound Test unbound Asuswrt-Merlin AddOns 6

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 776 (members: 38, guests: 738)
Top