Dnsmasq[3064]: reply error is SERVFAIL (EDE: DNSSEC bogus)

Help
1

Please follow the below template, it will help us to help you!

Expected Behaviour:

i expect the rpi-pihole to return DNS requests as it usually does.

  • Debian GNU/Linux 12 (bookworm) / DietPi v10.5.2 / pihole 6.6.2 w/ unbound
  • RPi 4 Model B (aarch64)
  • Docker: n/a
  • Docker: n/a

Actual Behaviour:

LAN DNS requests are returned correctly. requests for DNS resolves out on the net, SERVFAIL is returned. tested locally on the rpi pihole in question:

<<>> DiG 9.18.49-1~deb12u1-Debian <<>> pi-hole.net @127.0.0.1 -p 5335
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 59248

Debug Token:

GfiXUjxo

3

You are using Unbound as upstream DNS server.

If you enabled DNSSEC in the Unbound settings, disable it on Pi-hole and check again.

4

i disabled DNSSEC, restarted pihole-FTL, same SERVFAIL returned.

i tried these cmds to check if the rpi-pihole in question can reach & talk with root servers. the rpi-pihole in question returned this: keyword REFUSED...

dig @198.41.0.4 . NS +norec +time=3
dig @198.41.0.4 . NS +norec +tcp +time=3

;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 63296
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

the other pihole that has basically the same setup/configs works. this one in question glitches once in while. it is not on a vpn and it can ping and touch entities on the net using ip.

all i know for now. i'll work it some more tomorrow. thanks

5

What if you run below similar query on another machine that can be Windows, MacOS or Linux?

C:\>nslookup -debug -type=ns . 198.41.0.4
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 1, rcode = NOERROR
        header flags:  response, want recursion
        questions = 1,  answers = 0,  authority records = 6,  additional = 12

    QUESTIONS:
        4.0.41.198.in-addr.arpa, type = PTR, class = IN
    AUTHORITY RECORDS:
    ->  in-addr.arpa
        nameserver = f.in-addr-servers.arpa
        ttl = 172800 (2 days)
    ->  in-addr.arpa
        nameserver = b.in-addr-servers.arpa
        ttl = 172800 (2 days)
    ->  in-addr.arpa
        nameserver = d.in-addr-servers.arpa
        ttl = 172800 (2 days)
    ->  in-addr.arpa
        nameserver = a.in-addr-servers.arpa
        ttl = 172800 (2 days)
    ->  in-addr.arpa
        nameserver = c.in-addr-servers.arpa
        ttl = 172800 (2 days)
    ->  in-addr.arpa
        nameserver = e.in-addr-servers.arpa
        ttl = 172800 (2 days)
    ADDITIONAL RECORDS:
    ->  f.in-addr-servers.arpa
        internet address = 193.0.9.1
        ttl = 172800 (2 days)
    ->  f.in-addr-servers.arpa
        AAAA IPv6 address = 2a13:27c0:30::1
        ttl = 172800 (2 days)
    ->  b.in-addr-servers.arpa
        internet address = 199.253.183.183
        ttl = 172800 (2 days)
    ->  b.in-addr-servers.arpa
        AAAA IPv6 address = 2001:500:87::87
        ttl = 172800 (2 days)
    ->  d.in-addr-servers.arpa
        internet address = 200.10.60.53
        ttl = 172800 (2 days)
    ->  d.in-addr-servers.arpa
        AAAA IPv6 address = 2001:13c7:7010::53
        ttl = 172800 (2 days)
    ->  a.in-addr-servers.arpa
        internet address = 199.180.182.53
        ttl = 172800 (2 days)
    ->  a.in-addr-servers.arpa
        AAAA IPv6 address = 2620:37:e000::53
        ttl = 172800 (2 days)
    ->  c.in-addr-servers.arpa
        internet address = 196.216.169.10
        ttl = 172800 (2 days)
    ->  c.in-addr-servers.arpa
        AAAA IPv6 address = 2001:43f8:110::10
        ttl = 172800 (2 days)
    ->  e.in-addr-servers.arpa
        internet address = 203.119.86.101
        ttl = 172800 (2 days)
    ->  e.in-addr-servers.arpa
        AAAA IPv6 address = 2001:dd8:6::101
        ttl = 172800 (2 days)

------------
in-addr.arpa
        nameserver = f.in-addr-servers.arpa
        ttl = 172800 (2 days)
in-addr.arpa
        nameserver = b.in-addr-servers.arpa
        ttl = 172800 (2 days)
in-addr.arpa
        nameserver = d.in-addr-servers.arpa
        ttl = 172800 (2 days)
in-addr.arpa
        nameserver = a.in-addr-servers.arpa
        ttl = 172800 (2 days)
in-addr.arpa
        nameserver = c.in-addr-servers.arpa
        ttl = 172800 (2 days)
in-addr.arpa
        nameserver = e.in-addr-servers.arpa
        ttl = 172800 (2 days)
f.in-addr-servers.arpa
        internet address = 193.0.9.1
        ttl = 172800 (2 days)
f.in-addr-servers.arpa
        AAAA IPv6 address = 2a13:27c0:30::1
        ttl = 172800 (2 days)
b.in-addr-servers.arpa
        internet address = 199.253.183.183
        ttl = 172800 (2 days)
b.in-addr-servers.arpa
        AAAA IPv6 address = 2001:500:87::87
        ttl = 172800 (2 days)
d.in-addr-servers.arpa
        internet address = 200.10.60.53
        ttl = 172800 (2 days)
d.in-addr-servers.arpa
        AAAA IPv6 address = 2001:13c7:7010::53
        ttl = 172800 (2 days)
a.in-addr-servers.arpa
        internet address = 199.180.182.53
        ttl = 172800 (2 days)
a.in-addr-servers.arpa
        AAAA IPv6 address = 2620:37:e000::53
        ttl = 172800 (2 days)
c.in-addr-servers.arpa
        internet address = 196.216.169.10
        ttl = 172800 (2 days)
c.in-addr-servers.arpa
        AAAA IPv6 address = 2001:43f8:110::10
        ttl = 172800 (2 days)
e.in-addr-servers.arpa
        internet address = 203.119.86.101
        ttl = 172800 (2 days)
e.in-addr-servers.arpa
        AAAA IPv6 address = 2001:dd8:6::101
        ttl = 172800 (2 days)
Server:  UnKnown
Address:  198.41.0.4

------------
Got answer:
    HEADER:
        opcode = QUERY, id = 2, rcode = NOERROR
        header flags:  response, auth. answer, want recursion
        questions = 1,  answers = 13,  authority records = 0,  additional = 13

    QUESTIONS:
        (root), type = NS, class = IN
    ANSWERS:
    ->  (root)
        nameserver = l.root-servers.net
        ttl = 518400 (6 days)
    ->  (root)
        nameserver = j.root-servers.net
        ttl = 518400 (6 days)
    ->  (root)
        nameserver = f.root-servers.net
        ttl = 518400 (6 days)
    ->  (root)
        nameserver = h.root-servers.net
        ttl = 518400 (6 days)
    ->  (root)
        nameserver = d.root-servers.net
        ttl = 518400 (6 days)
    ->  (root)
        nameserver = b.root-servers.net
        ttl = 518400 (6 days)
    ->  (root)
        nameserver = k.root-servers.net
        ttl = 518400 (6 days)
    ->  (root)
        nameserver = i.root-servers.net
        ttl = 518400 (6 days)
    ->  (root)
        nameserver = m.root-servers.net
        ttl = 518400 (6 days)
    ->  (root)
        nameserver = e.root-servers.net
        ttl = 518400 (6 days)
    ->  (root)
        nameserver = g.root-servers.net
        ttl = 518400 (6 days)
    ->  (root)
        nameserver = c.root-servers.net
        ttl = 518400 (6 days)
    ->  (root)
        nameserver = a.root-servers.net
        ttl = 518400 (6 days)
    ADDITIONAL RECORDS:
    ->  l.root-servers.net
        internet address = 199.7.83.42
        ttl = 518400 (6 days)
    ->  l.root-servers.net
        AAAA IPv6 address = 2001:500:9f::42
        ttl = 518400 (6 days)
    ->  j.root-servers.net
        internet address = 192.58.128.30
        ttl = 518400 (6 days)
    ->  j.root-servers.net
        AAAA IPv6 address = 2001:503:c27::2:30
        ttl = 518400 (6 days)
    ->  f.root-servers.net
        internet address = 192.5.5.241
        ttl = 518400 (6 days)
    ->  f.root-servers.net
        AAAA IPv6 address = 2001:500:2f::f
        ttl = 518400 (6 days)
    ->  h.root-servers.net
        internet address = 198.97.190.53
        ttl = 518400 (6 days)
    ->  h.root-servers.net
        AAAA IPv6 address = 2001:500:1::53
        ttl = 518400 (6 days)
    ->  d.root-servers.net
        internet address = 199.7.91.13
        ttl = 518400 (6 days)
    ->  d.root-servers.net
        AAAA IPv6 address = 2001:500:2d::d
        ttl = 518400 (6 days)
    ->  b.root-servers.net
        internet address = 170.247.170.2
        ttl = 518400 (6 days)
    ->  b.root-servers.net
        AAAA IPv6 address = 2801:1b8:10::b
        ttl = 518400 (6 days)
    ->  k.root-servers.net
        internet address = 193.0.14.129
        ttl = 518400 (6 days)

------------
(root)
        nameserver = l.root-servers.net
        ttl = 518400 (6 days)
(root)
        nameserver = j.root-servers.net
        ttl = 518400 (6 days)
(root)
        nameserver = f.root-servers.net
        ttl = 518400 (6 days)
(root)
        nameserver = h.root-servers.net
        ttl = 518400 (6 days)
(root)
        nameserver = d.root-servers.net
        ttl = 518400 (6 days)
(root)
        nameserver = b.root-servers.net
        ttl = 518400 (6 days)
(root)
        nameserver = k.root-servers.net
        ttl = 518400 (6 days)
(root)
        nameserver = i.root-servers.net
        ttl = 518400 (6 days)
(root)
        nameserver = m.root-servers.net
        ttl = 518400 (6 days)
(root)
        nameserver = e.root-servers.net
        ttl = 518400 (6 days)
(root)
        nameserver = g.root-servers.net
        ttl = 518400 (6 days)
(root)
        nameserver = c.root-servers.net
        ttl = 518400 (6 days)
(root)
        nameserver = a.root-servers.net
        ttl = 518400 (6 days)
l.root-servers.net
        internet address = 199.7.83.42
        ttl = 518400 (6 days)
l.root-servers.net
        AAAA IPv6 address = 2001:500:9f::42
        ttl = 518400 (6 days)
j.root-servers.net
        internet address = 192.58.128.30
        ttl = 518400 (6 days)
j.root-servers.net
        AAAA IPv6 address = 2001:503:c27::2:30
        ttl = 518400 (6 days)
f.root-servers.net
        internet address = 192.5.5.241
        ttl = 518400 (6 days)
f.root-servers.net
        AAAA IPv6 address = 2001:500:2f::f
        ttl = 518400 (6 days)
h.root-servers.net
        internet address = 198.97.190.53
        ttl = 518400 (6 days)
h.root-servers.net
        AAAA IPv6 address = 2001:500:1::53
        ttl = 518400 (6 days)
d.root-servers.net
        internet address = 199.7.91.13
        ttl = 518400 (6 days)
d.root-servers.net
        AAAA IPv6 address = 2001:500:2d::d
        ttl = 518400 (6 days)
b.root-servers.net
        internet address = 170.247.170.2
        ttl = 518400 (6 days)
b.root-servers.net
        AAAA IPv6 address = 2801:1b8:10::b
        ttl = 518400 (6 days)
k.root-servers.net
        internet address = 193.0.14.129
        ttl = 518400 (6 days)

Any CGNAT addresses displayed if do below traceroute?

traceroute -n 8.8.8.8

The allocated address block is 100.64.0.0/10, i.e. IP addresses from 100.64.0.0 to 100.127.255.255.

EDIT: Oh and make sure date/time is accurate and syncing on the Pi-hole host!

timedatectl

Not related I guess but just to be sure.

6 
# apologies for late reply. here are outputs from your suggested cmd's...
# this cmd was executed on a fedora notebook with the rpi in question as its DNS resolver, following is output:

nslookup -debug -type=ns . 198.41.0.4  
Server:		198.41.0.4
Address:	198.41.0.4#53

------------
    QUESTIONS:
	., type = NS, class = IN
    ANSWERS:
    ->  .
	nameserver = d.root-servers.net.
	ttl = 4269
    ->  .
	nameserver = b.root-servers.net.
	ttl = 4269
    ->  .
	nameserver = k.root-servers.net.
	ttl = 4269
    ->  .
	nameserver = i.root-servers.net.
	ttl = 4269
    ->  .
	nameserver = m.root-servers.net.
	ttl = 4269
    ->  .
	nameserver = e.root-servers.net.
	ttl = 4269
    ->  .
	nameserver = g.root-servers.net.
	ttl = 4269
    ->  .
	nameserver = c.root-servers.net.
	ttl = 4269
    ->  .
	nameserver = a.root-servers.net.
	ttl = 4269
    ->  .
	nameserver = l.root-servers.net.
	ttl = 4269
    ->  .
	nameserver = j.root-servers.net.
	ttl = 4269
    ->  .
	nameserver = f.root-servers.net.
	ttl = 4269
    ->  .
	nameserver = h.root-servers.net.
	ttl = 4269
    AUTHORITY RECORDS:
    ADDITIONAL RECORDS:
------------
Non-authoritative answer:
.	nameserver = d.root-servers.net.
.	nameserver = b.root-servers.net.
.	nameserver = k.root-servers.net.
.	nameserver = i.root-servers.net.
.	nameserver = m.root-servers.net.
.	nameserver = e.root-servers.net.
.	nameserver = g.root-servers.net.
.	nameserver = c.root-servers.net.
.	nameserver = a.root-servers.net.
.	nameserver = l.root-servers.net.
.	nameserver = j.root-servers.net.
.	nameserver = f.root-servers.net.
.	nameserver = h.root-servers.net.

Authoritative answers can be found from:

#--------------------------------------
traceroute -n 8.8.8.8

#the were no CGNAT addresses displayed in the range 100.64.0.0 to 100.127.255.255.

#--------------------------------------

timedatectl status
#returned correct time 

#timeserver is on LAN via another rpi/dietpi/chronyd

sudo systemctl status systemd-timesyncd.service
#shows the rpi in question is contacting the local time server with successful time sync...
 #systemd-timesyncd[217838]: Contacted time server 192.168.1.192:123 (192.168.1.192)

#--------------------------------------
7

nslookup output can differ slightly between Windows and Linux.
But when I run that query on my Debian host, it returns ADDITIONAL RECORDS which seems to be missing from your output:

$ nslookup -debug -type=ns . 198.41.0.4
Server:         198.41.0.4
Address:        198.41.0.4#53

------------
    QUESTIONS:
        ., type = NS, class = IN
    ANSWERS:
    ->  .
        nameserver = l.root-servers.net.
        ttl = 518400
    ->  .
        nameserver = j.root-servers.net.
        ttl = 518400
    ->  .
        nameserver = f.root-servers.net.
        ttl = 518400
    ->  .
        nameserver = h.root-servers.net.
        ttl = 518400
    ->  .
        nameserver = d.root-servers.net.
        ttl = 518400
    ->  .
        nameserver = b.root-servers.net.
        ttl = 518400
    ->  .
        nameserver = k.root-servers.net.
        ttl = 518400
    ->  .
        nameserver = i.root-servers.net.
        ttl = 518400
    ->  .
        nameserver = m.root-servers.net.
        ttl = 518400
    ->  .
        nameserver = e.root-servers.net.
        ttl = 518400
    ->  .
        nameserver = g.root-servers.net.
        ttl = 518400
    ->  .
        nameserver = c.root-servers.net.
        ttl = 518400
    ->  .
        nameserver = a.root-servers.net.
        ttl = 518400
    AUTHORITY RECORDS:
    ADDITIONAL RECORDS:
    ->  l.root-servers.net
        internet address = 199.7.83.42
        ttl = 518400
    ->  l.root-servers.net
        has AAAA address 2001:500:9f::42
        ttl = 518400
    ->  j.root-servers.net
        internet address = 192.58.128.30
        ttl = 518400
    ->  j.root-servers.net
        has AAAA address 2001:503:c27::2:30
        ttl = 518400
    ->  f.root-servers.net
        internet address = 192.5.5.241
        ttl = 518400
    ->  f.root-servers.net
        has AAAA address 2001:500:2f::f
        ttl = 518400
    ->  h.root-servers.net
        internet address = 198.97.190.53
        ttl = 518400
    ->  h.root-servers.net
        has AAAA address 2001:500:1::53
        ttl = 518400
    ->  d.root-servers.net
        internet address = 199.7.91.13
        ttl = 518400
    ->  d.root-servers.net
        has AAAA address 2001:500:2d::d
        ttl = 518400
    ->  b.root-servers.net
        internet address = 170.247.170.2
        ttl = 518400
    ->  b.root-servers.net
        has AAAA address 2801:1b8:10::b
        ttl = 518400
    ->  k.root-servers.net
        internet address = 193.0.14.129
        ttl = 518400
------------
.       nameserver = l.root-servers.net.
.       nameserver = j.root-servers.net.
.       nameserver = f.root-servers.net.
.       nameserver = h.root-servers.net.
.       nameserver = d.root-servers.net.
.       nameserver = b.root-servers.net.
.       nameserver = k.root-servers.net.
.       nameserver = i.root-servers.net.
.       nameserver = m.root-servers.net.
.       nameserver = e.root-servers.net.
.       nameserver = g.root-servers.net.
.       nameserver = c.root-servers.net.
.       nameserver = a.root-servers.net.

Which makes me suspect something upstream in the network is tampering/intercepting/censoring DNS traffic.
You can double check if run below one which queries each of the 13 DNS root servers for their version (via IPv4 only):

$ awk '/ A / {print "@"$4}' /usr/share/dns/root.hints | xargs -n1 dig +norecurse +short version.bind chaos txt
"ATLAS"
"bind 9.x"
"c-root"
"NSD 4"
"2026.6.0"
"9.20.24"
"NSD 4.x"
"contact info@netnod.se"
"NSD"
"Knot DNS"
"Knot DNS 3"
"9.16"

If you dont get a similar reply, I recommend contacting your ISP for assistance.
Also ask them if they apply CGNAT just to be sure.

8

didn't get a reply. i ended up uninstalling pihole and reinstalling and it's returning DNS requests now. have no real clear reason why it stopped returning DNS requests but it's working now. i'll just wait and see if it stays that way or flakes out again. certainly appreciate your help and input!