Domains `aws.dev`, `dev`, `amazon.eu`, and `eu` in Query Log - What are these and why does Pi-hole query them?

[7wells]

Hello!

I see these in my Query Log (filtered for pi.hole) and wonder what they are and why Pi-hole queries them:

Thanks for sharing your thoughts!

[sawsanders]

Check out this post that explains DNSSEC

Understanding DNSSEC validation using Pi-hole's Query Log

Originally published at: https://pi-hole.net/2021/12/12/understanding-dnssec-validation-using-pi-holes-query-log/ The Domain Name System Security Extensions (DNSSEC) is an Internet standard that adds security mechanisms to the Domain Name System (DNS). It ensures both the authenticity and integrity of the DNS data. From FTL v5.9 on, Pi-hole shows and analyzes the internally generated DNSSEC queries needed to build the chain-to-trust. This feature is enabled by default and can be useful to p…

[7wells]

Sorry, but that is way beyond my capabilities of understanding.

[sawsanders]

Basically, it's trying to verify the authenticity of the DNS records and querying the upper level domains to see if they have signed records. It's a chain of trust starting from the top level, like .com or .eu etc.

[7wells]

Ok, but why is Pi-hole itself checking for aws and amazon? I would understand it if some of my many other clients ask for these, but Pi-hole?

[sawsanders]

Pi-hole is checking those to try and verify the chain of trust for the DNS requests your network made.

[7wells]

Oh my bad - thank you so much for your patience!
Remembering that I run Pi-hole in combination with unbound, I think I now understand it (hopefully ). So whenever I see such queries from pi.hole, I should not worry, right?

[sawsanders]

Correct.