DiscoveryPlus app will not stream video when going through pihole due to DNSSEC in pihole

[graysky2]

Trying to play video from the discoveryplus app (appletv) when going through pihole is not working. The app tries to start streaming but timesout and displays:

Something Went Wrong
CoreMediaErrorDomain.-19152

Interestingly, I see zero blocks in the pihole log for the appletv/all traffic is allowed.

When i change the DNS server on the WiFi to which the appletv connects, the app works as expected. Could there be some setting within pihole to blame that would not show a record in the log?

EDIT: see post #5 wherein I think I have it narrowed down to DNSSEC in pihole.

[jfb]

@graysky2

Could there be some setting within pihole to blame that would not show a record in the log?

Pi-hole logs all queries received (assuming you don't have logging disabled or privacy level set to record nothing).

If you see queries and they aren't blocked, then Pi-hole isn't blocking anything coming from that client.

Use these tools to ensure you are looking in all the right places for blocked domains:

How do I determine what domain an ad is coming from?

Block ads or fix broken sites This FAQ is written in the context of finding out how to block an ad that isn't blocked automatically, but the same steps can be used to troubleshoot issues with sites that don't function properly. An example is that sometimes certain payment gateways try to collect metrics on the sale, but these domains are blocked by Pi-hole, so the payment cannot be processed. Also, some links send you through several referrers and if one of them is blocked, you may land on a …

Another troubleshooting step - change the upstream DNS server used by Pi-hole and see if your problem clears.

[graysky2]

Thanks for the reply. I don't think any of the browser tools at the link you shared can help since the source is an App on an AppleTV (cannot install them on that device). I have been relying on the web UI for the AppleTV which should be the same log info as pihole -t. I will try changing the DNS in pihole and report back.

[graysky2]

I changed from cloudflare to quad 9 but same result: the app does start streaming when using the pihole as the DNS server and I do not get a single blocked request in pihole.

If I disable blocking within pihole in the web UI, the app still does not stream. Only configuring the DNS server on the AppleTV to use something else allows streaming to work.

Could there be anything else pihole is doing that could break streaming in this fashion? Again, the only difference is manually specifying pihole's DNS (10.0.4.250) in the AppleTV vs something like 9.9.9.9 or 1.1.1.1

[graysky2]

I found the issue: Settings>DNS>Advanced DNS settings>DNSSEC

Disabling DNSSEC allows streaming on the appleTV. If I enable it again, the streaming breaks.

@jfb -

1. Could pihole's implementation of DNSSEC be buggy or is it more likely that the DiscoverPlus app is buggy?
2. Is there a way in pihole to use DNSSEC for all clients but a special list by IP?

[jfb]

@graysky2

Could pihole's implementation of DNSSEC be buggy

We have had no bug reports, and it appears to work fine. This is part of the underlying dnsmasq software.

@graysky2

Is there a way in pihole to use DNSSEC for all clients but a special list by IP?

Not that I am aware of, but I am not a dnsmsaq expert.

Take a look back through you Pi-hole query log and the dnsmasq log at /var/log/pihole/pihole.log and see what replies were being received from the upstream DNS server when DNSSEC was enabled in Pi-hole. Any domains that were previously reported as BOGUS that are now not shown as such?

[graysky2]

With DNSSEC enabled, the only domain that gets reported as BOGUS is: _dns.resolver.arpa

[tomporter518]

Are all devices participating in DNSSEC time sync'd? DNSSEC relies on that condition to operate properly.

[graysky2]

@tomporter518

Are all devices participating in DNSSEC time sync'd?

I believe so. All are clients are running either iOS or Linux, client clocks seems synchronized.

EDIT: I confirmed the same timezone and date/time on pihole and one of the AppleTV.