Excessive requests for dns.msftncsi.com

hi

this stops the windows connectivity check process.

Basically, this results in windows reporting you are connected to the internet, even if you are not.

This would stop the repeated DNS requests but defeats the purpose of the LAN connectivity info.

What is annoying is that the connectivity check worked fine with pihole before www.msftncsi.com ended up on the block list.

Can the github domains blocklist be edited to remove entries? I'm a complete noob with linux but could probably follow instructions.

Having said this, I don't understand why whitelisting doesn't return behaviour to normal - could you query with the pihole devs?

regards,

Gary

Just to update / bring things to close.

This was resolved by the URL in question being removed from the block list by the list provider.

Regards,

Gary

I spent a couple months trying to resolve the "no internet" warning on my Windows 10 computer. I had blacklisted the URL because it was showing up so frequently in the Pi-hole log. I hadn't considered the blacklisted URL was the problem. When I whitelisted the URL, the "no internet" warning disappeared.

The domain now appears on this list: https://hostsfile.mine.nu/hosts0.txt

this is a custom list though, right?

It doesn't appear on my pihole (thankfully)

Gary

It is one of many publicly available lists on the internet.

ok, so basically it could affect pihole users but if one runs with the default setup, it shouldn't be an issue.

Correct. Domains come and go from lists and I didn't want anybody reading the thread to come to the conclusion that since this domain was removed from a specific list that it wouldn't exist on another list.

Whitelisting does this. In Pi-Hole terminology, a whitelist entry becomes a "gravity resistant domain," and is removed from gravity.

Interesting thread. I found the offending nvram entries on my Merlin/Asus RT-N66U (Updated to 380.70). I guess Merlin just copied much of the nvram over from the factory Asus/WRT. The firmware is Linux and I run Linux exclusively on this connection so WTF! It is probably present in all Asus routers.

having these issues myself now.... haven't found a straight forward answer on how to fix. Will try the telnet solution and report back.

used the telnet method described above and it worked. Still relevant in 2019....

If using Telnet isn't your thing, you can configure this via the GUI.
It'll likely be different for each router, but if you enable DNS Query and then clear the fields and apply, then disable DNS Query and apply again, you will find that the queries to dns.msftcsi.com will stop.
On my Asus router, this is found under Administration > System > Basic Config > Network Monitoring. Check boxes are for DNS Query and Ping.
Select the check box for DNS Query and then clear the fields for Resolve hostname and Resolved IP Addresses, then click Apply. Once the config has saved, clear the check box for DNS Query and click Apply again... problem solved.

1 Like

Thank you very much! It was exactly as you said on my Asus RT-AC57U v2 router. It was polling that domain every 10 seconds, and after following your algorithm the DNS spamming stopped.

If You're having ASUS Meshnetwork, You might have to update the NVRAM manually on each node.
There is a quick how-to here:
https://discourse.pi-hole.net/t/excessive-dns-msftncsi-com-dns-queries-originating-from-asus-router/3157/5

Thanks Brian for the tip above. It works getting rid of these queries. The problem when I disable it either via telnet or brian's technique is that the internet connection is shown as dead on the color indicator on top of the router (even though its not). Any way to fix this? Its a RT-AX82U.

I think I could even live with these DNS queries if it went to something like quad9 instead of microsoft.

I have RT-AX86U and with older firmware (before 08/2021), the solution above work.

However, with newer firmware (after 08/2021), ASUS will check the DNS probe to dns.msftncsi.com and if it's disabled, then the ASUS will mark the router as having no Internet connection.

I tested this with older firmware and it worked. As soon as I upgrade to the latest version, same problem above.

I think it's crap that ASUS now forced the router to send these DNS probes.

I've actually found out about this after setting up dual WAN on my ASUS GT-AC5300. If you enable dual WAN, the setting is configurable. I've set it to DNS probe every minute, instead of every 5sec.
By default the router will DNS query every 5sec, and failover after 12 consecutive fails (1min). (I believe this is the default for non DUAL WAN also, to check connectivity status.)
This seemed excessive to me, so I've changed it to DNS query every minute, and failover after 1 failed attempt (DNS queries shouldn't fail on a stable internet connection). So the failover time shouldn't' change, only the (excessive) queries.
Also, on my router the setting is configurable to use eighter DNS or PING, or both (ASUS has a table on their FAQ, why you should use one or the other, or both [Wireless Router] How to configure the Auto Network Detection while enabling the Dual WAN? | Official Support | ASUS Global).

I have a RT-AX86U and I solved the issue by enabling "Connect to DNS Server automatically" in WAN > WAN DNS Setting.

I have disabled DHCP on the router (I am using the pihole's DHCP server) but I am pointing to the pihole under LAN > DHCP Server > DNS Server.

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.