The Problem
I am experiencing issues trying to access some specific websites when DNSSEC is enabled.
- Without DNSSEC enabled, everything works as-expected (pages load normally).
- With DNSSEC enabled, some pages will not load on any device on the network, with the query log showing "DNSSEC status: ABANDONED", usually after either a 5s or 15s wait period.
- In particular, the only websites I have found this behaviour are those of companies under the Lloyds Banking Group e.g. lloydsbank.com, halifax.co.uk, bankofscotland.co.uk, and lexautolease.co.uk all fail to load.
- This issue occurs across multiple external DNS providers e.g. Quad9, Cloudflare
For now (as I have for a couple months) this issue can be avoided by disabling DNSSEC, but in the longer-term I would obviously prefer to have it enabled.
The System
- Currently this is occurring on core 6.4.3 and FTL 6.7, but the system is newly updated to this version and the issue was present prior to updating.
- Running on a Raspberry Pi, with Raspberry PI OS, kernel version 6.18, though similarly freshly updated with the issue not being new.
- Debug token at https://tricorder.pi-hole.net/uARWWKuq/
Additional Notes
- Using dnsviz.net to inspect DNSSEC status, these problem websites are the only ones I have found that give a particular error ("An iterations count of 0 must be used in NSEC3 records to alleviate computational burdens."). This seems plausibly relevant, but given how many users these websites have I assume there is at least some other factor specific to my setup as well.
- I have found one specific instance of someone maybe having the same problem, though no further information on resolving it: Strange behavior once DNSSEC is enabled - resolving issues inside the Pi-Hole black box - #26 by ZefremCond