2 domains constantly in queries only since setting up Unbound/PiVPN

Help Community Help
1

Versions

  • Pi-hole: 5.3.1
  • AdminLTE: 5.5
  • FTL: 5.8.1

Platform

Raspbian

  • OS and version: 10
  • Platform: Pi 3b

Actual behavior / bug

Using Homebridge and Pi-Hole on the same Pi. Two domains are generating excessive amounts of queries "local cache" from "localhost." The queries are related to one
Govee led strip and 2 Wyze smart plugs.
This all began when I setup PiVPN and Unbound, after they were up and running the queries spiked. Before when I this setup without PiVPN&Unbound everything was totally normal. I don't think the devices themselves are phoning home this often since this began the second I installed those two.
I have conditional forwarding and DNSSEC disabled.

Thanks!

Debug token —> https://tricorder.pi-hole.net/uf6tg9jaxw

image
image1284×939 86.1 KB

image
image1284×754 114 KB

2

The queries are originating from a source other than Pi-hole or unbound. Pi-hole simply receives queries from clients, then either blocks them or forwards them to an upstream resolver (unbound in your case) and returns the IP to the requesting client.

The third party app you are using to show Pi-hole queries shows that the domain developer-api.govee.com was answered from local cache, not originating there.

Run these two commands and post the output, which will show recent activity for these two domains from the dnsmasq log:

grep developer-api.govee.com /var/log/pihole.log | tail -n20

grep api.wyzecam.com /var/log/pihole.log | tail -n20

1 Like
3 
Jun 23 19:07:13 dnsmasq[24460]: query[AAAA] developer-api.govee.com from 127.0.0.1

Jun 23 19:07:13 dnsmasq[24460]: cached developer-api.govee.com is NODATA-IPv6

Jun 23 19:07:13 dnsmasq[24460]: query[A] developer-api.govee.com from 127.0.0.1

Jun 23 19:07:13 dnsmasq[24460]: cached developer-api.govee.com is 35.171.118.96

Jun 23 19:07:13 dnsmasq[24460]: cached developer-api.govee.com is 52.207.1.25

Jun 23 19:07:13 dnsmasq[24460]: cached developer-api.govee.com is 18.214.57.134

Jun 23 19:07:13 dnsmasq[24460]: cached developer-api.govee.com is 52.72.171.210

Jun 23 19:07:13 dnsmasq[24460]: cached developer-api.govee.com is 54.152.150.250

Jun 23 19:07:13 dnsmasq[24460]: cached developer-api.govee.com is 54.166.29.39

Jun 23 19:07:13 dnsmasq[24460]: query[AAAA] developer-api.govee.com from 127.0.0.1

Jun 23 19:07:13 dnsmasq[24460]: cached developer-api.govee.com is NODATA-IPv6

Jun 23 19:07:13 dnsmasq[24460]: query[A] developer-api.govee.com from 127.0.0.1

Jun 23 19:07:13 dnsmasq[24460]: cached developer-api.govee.com is 54.166.29.39

Jun 23 19:07:13 dnsmasq[24460]: cached developer-api.govee.com is 35.171.118.96

Jun 23 19:07:13 dnsmasq[24460]: cached developer-api.govee.com is 52.207.1.25

Jun 23 19:07:13 dnsmasq[24460]: cached developer-api.govee.com is 18.214.57.134

Jun 23 19:07:13 dnsmasq[24460]: cached developer-api.govee.com is 52.72.171.210

Jun 23 19:07:13 dnsmasq[24460]: cached developer-api.govee.com is 54.152.150.250

Jun 23 19:07:13 dnsmasq[24460]: query[AAAA] developer-api.govee.com from 127.0.0.1

Jun 23 19:07:13 dnsmasq[24460]: cached developer-api.govee.com is NODATA-IPv6

pi@raspberrypi:~ $ grep api.wyzecam.com /var/log/pihole.log | tail -n20

Jun 23 19:09:17 dnsmasq[24460]: query[A] api.wyzecam.com from 127.0.0.1

Jun 23 19:09:17 dnsmasq[24460]: cached api.wyzecam.com is <CNAME>

Jun 23 19:09:17 dnsmasq[24460]: query[AAAA] api.wyzecam.com from 127.0.0.1

Jun 23 19:09:17 dnsmasq[24460]: cached api.wyzecam.com is <CNAME>

Jun 23 19:09:23 dnsmasq[24460]: query[A] api.wyzecam.com from 127.0.0.1

Jun 23 19:09:23 dnsmasq[24460]: cached api.wyzecam.com is <CNAME>

Jun 23 19:09:23 dnsmasq[24460]: query[AAAA] api.wyzecam.com from 127.0.0.1

Jun 23 19:09:23 dnsmasq[24460]: cached api.wyzecam.com is <CNAME>

Jun 23 19:09:28 dnsmasq[24460]: query[A] api.wyzecam.com from 127.0.0.1

Jun 23 19:09:28 dnsmasq[24460]: cached api.wyzecam.com is <CNAME>

Jun 23 19:09:28 dnsmasq[24460]: query[AAAA] api.wyzecam.com from 127.0.0.1

Jun 23 19:09:28 dnsmasq[24460]: cached api.wyzecam.com is <CNAME>

Jun 23 19:09:34 dnsmasq[24460]: query[A] api.wyzecam.com from 127.0.0.1

Jun 23 19:09:34 dnsmasq[24460]: cached api.wyzecam.com is <CNAME>

Jun 23 19:09:34 dnsmasq[24460]: query[AAAA] api.wyzecam.com from 127.0.0.1

Jun 23 19:09:34 dnsmasq[24460]: cached api.wyzecam.com is <CNAME>

Jun 23 19:09:39 dnsmasq[24460]: query[A] api.wyzecam.com from 127.0.0.1

Jun 23 19:09:39 dnsmasq[24460]: cached api.wyzecam.com is <CNAME>

Jun 23 19:09:39 dnsmasq[24460]: query[AAAA] api.wyzecam.com from 127.0.0.1

Jun 23 19:09:39 dnsmasq[24460]: cached api.wyzecam.com is <CNAME>
4

This appears to be from the homebridge software running on the Pi. That is the IP at 127.0.0.1 (the loopback, or internal, IP of the Pi).

1 Like
5

Thanks I’ll reach out to Homebridge support.

6

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.