Api.nzbgeek.info is resolving to NXDOMAIN

Help Community Help
1

The issue I am facing:

Hello last week pi-hole started to return NXDOMAIN for api.nzbgeek.info. this is odd since no settings have been changed on my network. I've searched around for an answer to my issue and found the a thread which seemed to be about the same type of issue but I it didn't end up being the solution. since that issue was caused by a safe browsing feature.

I also ran grep api.nzbgeek.info /var/log/pihole.log | tail -n20 with the below output

I dont think it is being blocked I ran pihole -q -exact api.nbzgeek.info with the below output

[i] No exact results found for api.nbzgeek.info within the adlists

I also ran a nslookup api.nzbgeek.info 8.8.8.8 but it seems like it returns a non authoritative answer

I have flushed network table/ logs and restarted the dns resolver
I have rebooted every system in the chain
I have deleted all browser history/cache
I am out of ideas on what could be the issue here.

Details about my system:
I am running pi-hole on a rasberrypi zero

I have a asus RT-AX88U router

  • runs DHCP
  • does not have safe browsing enabled
  • uses pi hole as DNS

What I have changed since installing Pi-hole:
I had a server that was taken down last week but nothing should have changed on the network side.

here is the link to my log
https://tricorder.pi-hole.net/U79ahfXF/

2

Your debug log shows that you are using Pi-hole's default blocking mode.
By default, Pi-hole would not return NXDOMAIN, but 0.0.0.0 to block a domain. so NXDOMAIN is the reply as returned by Pi-hole's upstream.

You should be able to confirm that by running dig api.nzbgeek.info against your Pi-hole's upstream DNS server on your Pi-hole machine.

3

Your upstream (unbound?) is returning that NXDOMAIN result.

   Jul 30 03:22:24 dnsmasq[2335]: query[A] https://api.nzbgeek.info from 192.168.50.185
   Jul 30 03:22:24 dnsmasq[2335]: forwarded https://api.nzbgeek.info to 127.0.0.1#5335
   Jul 30 03:22:24 dnsmasq[2335]: query[AAAA] https://api.nzbgeek.info from 192.168.50.185
   Jul 30 03:22:24 dnsmasq[2335]: forwarded https://api.nzbgeek.info to 127.0.0.1#5335
   Jul 30 03:22:24 dnsmasq[2335]: query[A] https://api.nzbgeek.info from 192.168.50.185
   Jul 30 03:22:24 dnsmasq[2335]: query[AAAA] https://api.nzbgeek.info from 192.168.50.185
   Jul 30 03:22:24 dnsmasq[2335]: query[A] https://api.nzbgeek.info from 192.168.50.185
   Jul 30 03:22:24 dnsmasq[2335]: query[AAAA] https://api.nzbgeek.info from 192.168.50.185
   Jul 30 03:22:24 dnsmasq[2335]: reply https://api.nzbgeek.info is NXDOMAIN
   Jul 30 03:22:24 dnsmasq[2335]: query[A] https://api.nzbgeek.info from 192.168.50.185
   Jul 30 03:22:24 dnsmasq[2335]: forwarded https://api.nzbgeek.info to 127.0.0.1#5335
   Jul 30 03:22:24 dnsmasq[2335]: reply https://api.nzbgeek.info is NXDOMAIN
   Jul 30 03:22:24 dnsmasq[2335]: query[AAAA] https://api.nzbgeek.info from 192.168.50.185
   Jul 30 03:22:24 dnsmasq[2335]: query[A] https://api.nzbgeek.info from 192.168.50.185
   Jul 30 03:22:24 dnsmasq[2335]: forwarded https://api.nzbgeek.info to 127.0.0.1#5335
   Jul 30 03:22:24 dnsmasq[2335]: reply https://api.nzbgeek.info is NXDOMAIN
   Jul 30 03:22:24 dnsmasq[2335]: query[AAAA] https://api.nzbgeek.info from 192.168.50.185
   Jul 30 03:22:24 dnsmasq[2335]: query[A] https://api.nzbgeek.info from 192.168.50.185
   Jul 30 03:22:24 dnsmasq[2335]: forwarded https://api.nzbgeek.info to 127.0.0.1#5335
   Jul 30 03:22:24 dnsmasq[2335]: reply https://api.nzbgeek.info is NXDOMAIN
4

I should have looked more carefully - Dan quoting from your log reveals an additional significant detail:

The DNS request that was logged here was for https://api.nzbgeek.info.
That is a URL rather than a domain and will always be replied with NXDOMAIN, as domains never would start with https://

7

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.