DNS appending local domain to queries

Help
1

Expected Behaviour:

Pihole 5.1.2 should resolve DNS entries for domains outside of my network.

Actual Behaviour:

Since upgrading to PiHole 5.1.2 (previously PiHole 5.1.0), several DNS queries are showing up in the Query log as something like: foo.bar.com.thecobbclan.com, obviously with no results for A and AAAA records. The reason is, foo.bar.com is a host outside of my local domain, while thecobbclan.com is my local domain. Previous to upgrading, if I tried to resolve foo.bar.com, it would get resolved successfully; now, on certain hosts in my network, it will always append my local domain to all queries and will subsequently fail.

Debug Token:

https://tricorder.pi-hole.net/k4iizzp3iu

2

It depends on the client. Windows will append the local domain to anything that it can. If you're assigning the PI-hole IP address as a DHCP lease, though not a good idea, you can check /etc/resolv.conf and see if there is any search domains added on.

As an aside, using a real domain as your local domain is going to be problematic. Queries will be forwarded that you don't want and things will leak out that you may not want known.

3

In this case, it's a Kubernetes pod running on an Ubuntu cluster node, which the host is getting DNS from the Pi hole issued DHCP. Fwiw, the node (and pods running on it) was resolving fine prior to the pihole upgrade; afterwards, it's now appending the local domain to every query.

4

Nothing has changed in Pi-hole that would add any kind of additional searching.

5

Check the logs, the queries are coming from the client at .102, that's the best place to start investigating.

*** [ DIAGNOSING ]: Pi-hole log
-rw-r--r-- 1 pihole pihole 20087087 Aug 30 14:11 /var/log/pihole.log
   -----head of pihole.log------
   Aug 30 00:00:08 dnsmasq[695]: query[A] rancher.thecobbclan.com from 10.0.1.102
   Aug 30 00:00:08 dnsmasq[695]: /etc/pihole/lan.list rancher.thecobbclan.com is 10.0.1.21
   Aug 30 00:00:08 dnsmasq[695]: query[AAAA] rancher.thecobbclan.com from 10.0.1.102
   Aug 30 00:00:08 dnsmasq[695]: cached rancher.thecobbclan.com is NODATA-IPv6
   Aug 30 00:00:08 dnsmasq[695]: query[AAAA] rancher.thecobbclan.com from 10.0.1.103
   Aug 30 00:00:08 dnsmasq[695]: cached rancher.thecobbclan.com is NODATA-IPv6
   Aug 30 00:00:08 dnsmasq[695]: query[A] rancher.thecobbclan.com from 10.0.1.103
   Aug 30 00:00:08 dnsmasq[695]: /etc/pihole/lan.list rancher.thecobbclan.com is 10.0.1.21
   Aug 30 00:00:10 dnsmasq[695]: query[A] connectivitycheck.gstatic.com from 10.0.1.168
   Aug 30 00:00:10 dnsmasq[695]: forwarded connectivitycheck.gstatic.com to 127.0.0.1
   Aug 30 00:00:10 dnsmasq[695]: validation result is INSECURE
   Aug 30 00:00:10 dnsmasq[695]: reply connectivitycheck.gstatic.com is 172.217.14.227
   Aug 30 00:00:11 dnsmasq[695]: query[TXT] debug.opendns.com from 10.0.1.39
   Aug 30 00:00:11 dnsmasq[695]: forwarded debug.opendns.com to 127.0.0.1
   Aug 30 00:00:11 dnsmasq[695]: validation result is INSECURE
   Aug 30 00:00:17 dnsmasq[695]: query[AAAA] rancher.thecobbclan.com from 10.0.1.77
   Aug 30 00:00:17 dnsmasq[695]: cached rancher.thecobbclan.com is NODATA-IPv6
   Aug 30 00:00:17 dnsmasq[695]: query[A] rancher.thecobbclan.com from 10.0.1.77
   Aug 30 00:00:17 dnsmasq[695]: /etc/pihole/lan.list rancher.thecobbclan.com is 10.0.1.21
   Aug 30 00:00:21 dnsmasq[695]: query[TXT] debug.opendns.com from 10.0.1.39
6

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.