DNS querying is being truncated and failing

Help Community Help
1

The issue I am facing:
I have a brand new system that I have built(it is protected etc). The upstream resolver is a local unbound + cloudflared. This morning I noticed I was having issues logging into one of my financial institutions. Upon investigation I saw that my browser was making queries to identify api.prod.projectfinance.io. But these specific queries were hanging. The results when I used dig/nslookup are

dig api.prod.projectfinance.io
;; Truncated, retrying in TCP mode.
;; Connection to x.x.x.x.#53(x.x.x.x) for api.prod.projectfinance.io failed: timed out.
;; no servers could be reached

The weird thing is when I exec into my docker pihole container and I do a dig it resolves fine. It is just pihole is having a problem dishing out results to my devices.

Here are some of the entries I find in /var/log/pihole.log inside my docker container.

Oct 8 09:14:53 dnsmasq[60286]: query[A] api.prod.projectfinance.io from x.y.a.b
Oct 8 09:14:53 dnsmasq[60286]: forwarded api.prod.projectfinance.io to 10.0.0.2
Oct 8 09:14:53 dnsmasq[60286]: dnssec-query[DNSKEY] impervadns.net to 10.0.0.2
Oct 8 09:14:53 dnsmasq[60286]: reply impervadns.net is truncated[DNSKEY]
Oct 8 09:14:53 dnsmasq[60286]: validation result is TRUNCATED
Oct 8 09:14:53 dnsmasq[60286]: reply is truncated

I would appreciate any pointers in why am I running into this and how to sort it out?

Thank you!
g

Details about my system:
Pihole running inside docker with a local unbound + cloudlfared dnssec .

What I have changed since installing Pi-hole:
This is a brand new setup.

2

Is pihole allowed to use TCP for DNS queries in addition to UDP in your firewall?

3

By default, DNS employs UDP.
If a DNS reply is exceeding UDP's packet size limit, a truncated DNS reply will be delivered, which should prompt the client to repeat its DNS query via TCP (which allows larger contents to span several packets).

The log output you've shared shows that sequence up to Pi-hole's delivery of the truncated reply, and your dig output demonstrates that a truncated reply was received by the client.

Does your pihole.log immediately after those lines also show the repeated query?
Could you share the respective lines as well?

5

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.