DNSSEC Tests failed

Please follow the below template, it will help us to help you!

Expected Behaviour:

Passing most of DNSSEC Tests available on the Internet.

Actual Behaviour:

That doesn't happen at all. My config is this:
DNS: 1.1.1.1; 1.0.0.1
Pi Static Ip: 192.168.1.1
DNSSEC: enabled
I also set up openvpn, which works correctly.

Debug Token:

https://pastebin.com/raw/NkTyZEib

Check that the date/time on the Pi-Hole host matches your local time. Accurate time is required for DNSSEC authentication.

1 Like

Last Line of your debug log: BOGUS

   Nov 14 00:03:12 dnsmasq[22964]: dnssec-query[DS] com to 149.112.112.112
   Nov 14 00:03:12 dnsmasq[22964]: dnssec-query[DS] com to 149.112.112.112
   Nov 14 00:03:12 dnsmasq[22964]: dnssec-query[DS] com to 149.112.112.112
   Nov 14 00:03:12 dnsmasq[22964]: reply com is BOGUS DS

As said earlier here:

1 Like

I'll try for the 3rd time to reinstall the whole Raspbian OS on my RPi3B+, using that guide.

If you are on your third install, there may be a problem with your settings on the Pi OS. Check your timezone and time to ensure they are correct when you set this up.

pi@PiHole:~ $ timedatectl status
Local time: mer 2018-11-14 12:47:23 CET
Universal time: mer 2018-11-14 11:47:23 UTC
RTC time: n/a
Time zone: Europe/Rome (CET, +0100)
Network time on: yes
NTP synchronized: yes
RTC in local TZ: no

This is timedatectl output. As you can see, ntp works (even if locally it's 19:03). I don't know what to do.

NTP will only set the proper time if it is within an hour or so, November 14 2018 is too far out of date for NTP to correct so it does not do anything.

Try sudo ntpd -q to force an update.

pi@PiHole:~ $ sudo ntpd -q
14 Nov 13:32:18 ntpd[1068]: ntpd 4.2.8p10@1.3728-o Sat Mar 10 18:03:33 UTC 2018 (1): Starting
14 Nov 13:32:18 ntpd[1068]: Command line: ntpd -q
14 Nov 13:32:18 ntpd[1068]: proto: precision = 1.406 usec (-19)
14 Nov 13:32:18 ntpd[1068]: unable to bind to wildcard address :: - another process may be running - EXITING

Another error, it seems that something else is hogging the port (?)

Okay, does sudo ntpq -g set the proper time? It may not display anything on the command line, but run that command and check the time with date after a minute or so.

pi@PiHole:~/.ssh $ sudo ntpd -g
pi@PiHole:~/.ssh $ date
mer 14 nov 2018, 13.36.58, CET

This is the output. (really sorry if i'm making you annoyed)

ntpq takes a few minutes for it to agree on a time, give it a little bit of time and check again.

You can also set the date/time manually with this command - substitute the correct date/time for your location:

sudo date --set="21 December 2018 11:53:30"

Done, what about now? :slight_smile:

Are you able to resolve DNS queries now? From the Pi-Hole host terminal:

dig www.google.com

pi@PiHole:~ $ dig www.google.com

; <<>> DiG 9.10.3-P4-Raspbian <<>> www.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18476
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.google.com. IN A

;; ANSWER SECTION:
www.google.com. 60 IN A 216.58.198.36

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Fri Mar 29 20:14:40 CET 2019
;; MSG SIZE rcvd: 59

Yeah.

From this, it appears your problem is resolved.

Let me do a test with my phone, where i changed the dns.

I failed the test https://dnssec.vs.uni-due.de/

What DNS is the client using, and what upstream DNS is Pi-Hole using?

Generate a new debug log and upload it and post the token here.

I'll put it in pastebin, since uploading function doesn't work (don't ask me why, this is another thing, i'll open a new topic for that tomorrow).