Android appends DNS-Suffix to google domains

chris400 · May 18, 2021, 6:26am

I am running the official pi hole docker image, it also acts as DHCP. Router ist UniFi USG behind a AVM FRITZ!Box 7520.
Upload is 1&1 VDSL 35b (reselling Deutsche Telekom), 150/40.
".home" is my local domain name.

Note: there are some routing issues with Deutsche Telekom, esp. with cloudflare, see https://community.cloudflare.com/t/still-bad-routing-from-dtag-in-germany/265467

Expected Behaviour:

Opening links within official gmail app or google app on Android 11 should immediately display the content, same goes for gmail attachements.

Actual Behaviour:

Loading of attachements in gmail sometimes is stucked at 0%, clicking links in emails or performing search via google app loads ~5-10 seconds.

Entries in the query log look like this:
2021-05-18 08:00:52 A (IPv4) mobile-webview.gmail.com.home pixel3.home OK (cached)
2021-05-18 08:00:52 AAAA (IPv6) mobile-webview.gmail.com.home pixel3.home OK (cached)
2021-05-18 08:00:52 AAAA (IPv6) mobile-webview.gmail.com.home pixel3.home OK (cached)
2021-05-18 08:00:52 A (IPv4) mobile-webview.gmail.com.home pixel3.home OK (cached)
2021-05-18 08:00:52 AAAA (IPv6) mobile-webview.gmail.com pixel3.home OK (cached)
2021-05-18 08:00:52 A (IPv4) mobile-webview.gmail.com pixel3.home OK (cached)
2021-05-18 08:00:52 A (IPv4) mobile-webview.gmail.com.home pixel3.home OK (cached)
2021-05-18 08:00:52 AAAA (IPv6) mobile-webview.gmail.com.home pixel3.home OK (cached)

Debug Token:

https://tricorder.pi-hole.net/syzgdvg1is

Bucking_Horn · May 18, 2021, 7:37am

It's to be expected that queries are extended by the local search domain.
For public domains, that would prompt an NXDOMAIN reply.
This is also what I receive when digging your mobile-webview.gmail.com.home.

Yours return OK instead (edit: but then the Reply column is missing from your screenshot).
What IP address is returned? Or is it NXDOMAIN?

You may want to find out which server (edit: if any) is providing an IP address for mobile-webview.gmail.com.home or probably just mobile-webview.gmail.com in your network, and adjust or remove that as necessary.

chris400 · May 18, 2021, 9:01am

Both 'mobile-webview.gmail.com.home' and 'mobile-webview.gmail.com' do get an NXDOMAIN reply. Even Google's DNS does not know 'mobile-webview.gmail.com'.

I did test it on my windows computer and within the pi hole docker

May 18 11:00:21 dnsmasq[30023]: query[A] mobile-webview.gmail.com.home from 192.168.0.153
May 18 11:00:21 dnsmasq[30023]: config mobile-webview.gmail.com.home is NXDOMAIN
May 18 11:00:21 dnsmasq[30023]: query[AAAA] mobile-webview.gmail.com.home from 192.168.0.153
May 18 11:00:21 dnsmasq[30023]: config mobile-webview.gmail.com.home is NXDOMAIN
May 18 11:00:21 dnsmasq[30023]: query[A] mobile-webview.gmail.com from 192.168.0.153
May 18 11:00:21 dnsmasq[30023]: forwarded mobile-webview.gmail.com to 8.8.8.8
May 18 11:00:21 dnsmasq[30023]: reply mobile-webview.gmail.com is NXDOMAIN
May 18 11:00:21 dnsmasq[30023]: query[AAAA] mobile-webview.gmail.com from 192.168.0.153
May 18 11:00:21 dnsmasq[30023]: cached mobile-webview.gmail.com is NXDOMAIN

jfb · May 18, 2021, 2:36pm

The issue here is that clients are requesting resolution of domains that don't exist, or at least can't be resolved with the .home name appended. That is not a Pi-hole problem.

From my Pi terminal, the result is the same. The domain mobile-webview.gmail.com does not exist on the internet, nor does the domain mobile-webview.gmail.com.home

https://dnsviz.net/d/mobile-webview.gmail.com/dnssec/

chris400 · May 18, 2021, 2:58pm

What about the log in the webinterface: is 'OK (checked)' the expected output?

jfb · May 18, 2021, 3:20pm

Please look in either /var/log/pihole.log or /var/log/pihole.log.1 for that time frame and post the DNS transactions for that domain query, forward and reply, and post them here.

chris400 · May 18, 2021, 6:27pm

May 18 11:00:21 dnsmasq[30023]: query[PTR] 12.0.168.192.in-addr.arpa from 192.168.0.153
May 18 11:00:21 dnsmasq[30023]: /etc/hosts 192.168.0.12 is pihole.home
May 18 11:00:21 dnsmasq[30023]: query[A] mobile-webview.gmail.com.home from 192.168.0.153
May 18 11:00:21 dnsmasq[30023]: config mobile-webview.gmail.com.home is NXDOMAIN
May 18 11:00:21 dnsmasq[30023]: query[AAAA] mobile-webview.gmail.com.home from 192.168.0.153
May 18 11:00:21 dnsmasq[30023]: config mobile-webview.gmail.com.home is NXDOMAIN
May 18 11:00:21 dnsmasq[30023]: query[A] mobile-webview.gmail.com from 192.168.0.153
May 18 11:00:21 dnsmasq[30023]: forwarded mobile-webview.gmail.com to 8.8.8.8
May 18 11:00:21 dnsmasq[30023]: reply mobile-webview.gmail.com is NXDOMAIN
May 18 11:00:21 dnsmasq[30023]: query[AAAA] mobile-webview.gmail.com from 192.168.0.153
May 18 11:00:21 dnsmasq[30023]: cached mobile-webview.gmail.com is NXDOMAIN

jfb · May 18, 2021, 6:46pm

As expected, all the queries for this domain return as NXDOMAIN.

Bucking_Horn · May 18, 2021, 6:58pm

The timeframe does not match:

chris400 · May 18, 2021, 7:59pm

I'm so sorry.

May 18 08:00:52 dnsmasq[408]: query[AAAA] mobile-webview.gmail.com.home from 192.168.0.166
May 18 08:00:52 dnsmasq[408]: config mobile-webview.gmail.com.home is NXDOMAIN
May 18 08:00:52 dnsmasq[408]: query[A] mobile-webview.gmail.com.home from 192.168.0.166
May 18 08:00:52 dnsmasq[408]: config mobile-webview.gmail.com.home is NXDOMAIN
May 18 08:00:52 dnsmasq[408]: query[A] mobile-webview.gmail.com from 192.168.0.166
May 18 08:00:52 dnsmasq[408]: cached mobile-webview.gmail.com is NXDOMAIN
May 18 08:00:52 dnsmasq[408]: query[AAAA] mobile-webview.gmail.com from 192.168.0.166
May 18 08:00:52 dnsmasq[408]: cached mobile-webview.gmail.com is NXDOMAIN
May 18 08:00:52 dnsmasq[408]: query[A] mobile-webview.gmail.com.home from 192.168.0.166
May 18 08:00:52 dnsmasq[408]: config mobile-webview.gmail.com.home is NXDOMAIN
May 18 08:00:52 dnsmasq[408]: query[AAAA] mobile-webview.gmail.com.home from 192.168.0.166
May 18 08:00:52 dnsmasq[408]: config mobile-webview.gmail.com.home is NXDOMAIN
May 18 08:00:52 dnsmasq[408]: query[AAAA] mobile-webview.gmail.com.home from 192.168.0.166
May 18 08:00:52 dnsmasq[408]: config mobile-webview.gmail.com.home is NXDOMAIN
May 18 08:00:52 dnsmasq[408]: query[A] mobile-webview.gmail.com.home from 192.168.0.166
May 18 08:00:52 dnsmasq[408]: config mobile-webview.gmail.com.home is NXDOMAIN

Why does the webinterface say "OK (checked)" then?

Bucking_Horn · May 19, 2021, 7:34pm

I think that screenshot of yours is just missing the Reply column, which would have contained NXDOMAIN (and led to my confusion - sorry for that).
Your results look OK overall - my first answer fully applies.

chris400 · May 19, 2021, 8:07pm

There are only 6 columns:

Time
Type
Domain
Client
Status
Action

Maybe "Status" is not the same as "Reply"?

Bucking_Horn · May 19, 2021, 8:43pm

chris400 · May 20, 2021, 6:07am

Wait! What?! How do I get the seventh column?
EDIT:

There are two "Query Logs" in the webinterface. The first one has one column more: "Reply".

Is it possible to enable that column in the other Query Log to?

EDIT2:
I cannot go back that far in the first Query Log, but I do have I kind of a morning routine
These are todays entries:

=> "OK (cached)" is the correct and expectable Status, while "NXDOMAIN" is the correct and expectable Reply.

Thx for your assistance. I will create a feature request for the seventh column in the second Query Log.

DL6ER · May 20, 2021, 6:48am

No. The reply data (along with a lot more data in the background) is not stored in the database. There are (rough!) plans to maybe include more details in the future, however, mind that the database contains millions of entries so every new information will also cause a notable growth of the database.

system · June 10, 2021, 6:49am

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.