DNSSEC Issue - Can't access certain websites

Help
1

Expected Behaviour:

I am using PiHole and Unbound on a Raspberry Pi Model B+ that has 2 DNS resolvers (one recursive and one forwarding as a failover). I don't have any issues with accessing websites.

Actual Behaviour:

I haven't changed anything in a while (more than 2-3 months), but over the last 24 hours, certain websites are inaccessible with a DNS error while they show up as BOGUS in the query logs. In the past, they didn't have any issues.

Debug Token:

https://tricorder.pi-hole.net/Cbc5EDzA/

These are some of the behaviour for the current situation:

root@pi-infra:~# dig dnssec.works @127.0.0.1 -p 5335

dig fail01.dnssec.works @127.0.0.1 -p 5335

dig www.ebanking.piraeusbank.gr @127.0.0.1 -p 5335

dig account.cosmote.gr @127.0.0.1 -p 5335

timedatectl

; <<>> DiG 9.20.21-1~deb13u1-Raspbian <<>> dnssec.works @127.0.0.1 -p 5335

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35010

;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags:; udp: 1232

;; QUESTION SECTION:

;dnssec.works. IN A

;; ANSWER SECTION:

dnssec.works. 3600 IN A 46.23.92.212

;; Query time: 570 msec

;; SERVER: 127.0.0.1#5335(127.0.0.1) (UDP)

;; WHEN: Wed May 13 19:22:44 EEST 2026

;; MSG SIZE rcvd: 57

; <<>> DiG 9.20.21-1~deb13u1-Raspbian <<>> fail01.dnssec.works @127.0.0.1 -p 5335

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 60971

;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags:; udp: 1232

;; QUESTION SECTION:

;fail01.dnssec.works. IN A

;; Query time: 600 msec

;; SERVER: 127.0.0.1#5335(127.0.0.1) (UDP)

;; WHEN: Wed May 13 19:22:45 EEST 2026

;; MSG SIZE rcvd: 48

;; communications error to 127.0.0.1#5335: timed out

;; communications error to 127.0.0.1#5335: timed out

;; communications error to 127.0.0.1#5335: timed out

; <<>> DiG 9.20.21-1~deb13u1-Raspbian <<>> www.ebanking.piraeusbank.gr @127.0.0.1 -p 5335

;; global options: +cmd

;; no servers could be reached

;; communications error to 127.0.0.1#5335: timed out

;; communications error to 127.0.0.1#5335: timed out

; <<>> DiG 9.20.21-1~deb13u1-Raspbian <<>> account.cosmote.gr @127.0.0.1 -p 5335

;; global options: +cmd

;; Got answer:

;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 51519

;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:

; EDNS: version: 0, flags:; udp: 1232

;; QUESTION SECTION:

;account.cosmote.gr. IN A

;; Query time: 10 msec

;; SERVER: 127.0.0.1#5335(127.0.0.1) (UDP)

;; WHEN: Wed May 13 19:23:12 EEST 2026

;; MSG SIZE rcvd: 47

           Local time: Wed 2026-05-13 19:23:14 EEST

       Universal time: Wed 2026-05-13 16:23:14 UTC

             RTC time: n/a

            Time zone: Europe/Athens (EEST, +0300)

System clock synchronized: yes

          NTP service: inactive

      RTC in local TZ: no
2

Lately there have been reports of :

  • ISPs messing around with the traffic of their customers and because of that Unbound not being able to communicate correctly with the Root DNS Servers.
  • Sometimes users got switched to a CG-NAT connection and that can also bring along all kinds of weird issues...

So let's start with :

  • Posting tracert/traceroute output to a well known domain like google.com or microsoft.com
  • What does your Router show as the WAN IP Address ?
  • What does a website like https://whatismyipaddress.com/ show ?

The last two should show the same and if they don't and the tracert/traceroute also shows CG-NAT related IP Addresses (Carrier-grade NAT - Wikipedia) then you know enough :slight_smile:

3

Thanks for the pointers! They really helped me check more things.

Here’s what I’ve found:

  • My Flip2 router has two WANs:

    • Starlink WAN

    • Cosmote 5G WiFi: Router IP is 192.168.254.193 behind an outdoor CPE I cannot log into.

  • From my Mac, traceroute google.com shows early hops 100.64.0.1 and 172.x.x.x.

  • Public IPv4 from whatismyipaddress.com is 216.x.x.x.

So yes, both ISPs are putting me behind upstream NAT, and Starlink is clearly using CG‑NAT (the WAN IP on my router is 100.x, while the public IP is 216.x).

As additional information, my router is also a Tailscale node.

However, Unbound on my Pi can:

  • Validate DNSSEC correctly for test domains (dnssec.works vs fail01.dnssec.works).

  • Resolve and validate common services like Google's main API hostnames.

The DNSSEC issues show up only for a small set of domains (e.g. www.ebanking.piraeusbank.gr, account.cosmote.gr, and some Ecobee hostnames like home-fw.ecobee.com). For these, my validating Unbound returns SERVFAIL with EDE “DNSSEC bogus”, and the same domains sometimes fail from public resolvers on my fixed‑line path, while they work over mobile.

Could you maybe help me figure out if that is the problem or if I can ask my ISPs to change something in their settings?

4

Well you could ask your ISP if they can move you from the CG-NAT WAN IP Address to a real one, but I have no idea if all ISPs that use CG-NAT can do that for their customers, so that's for you to figure out! :slight_smile:

Before you do that you could also take a look at this older topic : Pi-hole works fine but unbound has a problem

And try to find similarities between that issue and your issue.

I have tested all the domains you mentioned and this is how the output should look like :

$ dig dnssec.works

; <<>> DiG 9.20.21-1~deb13u1-Debian <<>> dnssec.works
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18971
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;dnssec.works.                  IN      A

;; ANSWER SECTION:
dnssec.works.           3600    IN      A       46.23.92.212

;; Query time: 164 msec
;; SERVER: 10.0.0.139#53(10.0.0.139) (UDP)
;; WHEN: Fri May 15 16:28:36 CEST 2026
;; MSG SIZE  rcvd: 57



$ dig fail01.dnssec.works

; <<>> DiG 9.20.21-1~deb13u1-Debian <<>> fail01.dnssec.works
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 22844
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;fail01.dnssec.works.           IN      A

;; Query time: 112 msec
;; SERVER: 10.0.0.139#53(10.0.0.139) (UDP)
;; WHEN: Fri May 15 16:29:22 CEST 2026
;; MSG SIZE  rcvd: 48



$ dig www.ebanking.piraeusbank.gr

; <<>> DiG 9.20.21-1~deb13u1-Debian <<>> www.ebanking.piraeusbank.gr
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14388
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.ebanking.piraeusbank.gr.   IN      A

;; ANSWER SECTION:
www.ebanking.piraeusbank.gr. 300 IN     CNAME   d7vud2s.ng.impervadns.net.
d7vud2s.ng.impervadns.net. 30   IN      A       45.60.46.218

;; Query time: 192 msec
;; SERVER: 10.0.0.139#53(10.0.0.139) (UDP)
;; WHEN: Fri May 15 16:29:50 CEST 2026
;; MSG SIZE  rcvd: 111



$ dig account.cosmote.gr

; <<>> DiG 9.20.21-1~deb13u1-Debian <<>> account.cosmote.gr
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48865
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;account.cosmote.gr.            IN      A

;; ANSWER SECTION:
account.cosmote.gr.     86400   IN      CNAME   wnwvkq8.ng.impervadns.net.
wnwvkq8.ng.impervadns.net. 30   IN      A       45.60.74.72

;; Query time: 132 msec
;; SERVER: 10.0.0.139#53(10.0.0.139) (UDP)
;; WHEN: Fri May 15 16:30:19 CEST 2026
;; MSG SIZE  rcvd: 102



$ dig home-fw.ecobee.com

; <<>> DiG 9.20.21-1~deb13u1-Debian <<>> home-fw.ecobee.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31576
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;home-fw.ecobee.com.            IN      A

;; ANSWER SECTION:
home-fw.ecobee.com.     60      IN      CNAME   hxot636.ng.impervadns.net.
hxot636.ng.impervadns.net. 30   IN      A       45.223.101.23

;; Query time: 236 msec
;; SERVER: 10.0.0.139#53(10.0.0.139) (UDP)
;; WHEN: Fri May 15 16:31:00 CEST 2026
;; MSG SIZE  rcvd: 102

This was done from my Debian Linux laptop speaking to my Pi-Hole + Unbound setup :wink: