Millions of PTR Queries in-addr.arpa

There are literal millions of queries. How do i solve this?query

Edit: TURN OFF Conditional Forwarding, that seemed to be my issue

The first is a Bonjour request (Apple uses this). The second is likely related.

Do you have conditional forwarding enabled? That can cause a lot of circular traffic.

I did have it enabled, I continued to look for the culprit and figured that it sounded like it was.

Edit: Queries dropped from 8000 to 200 after disabling it. I'm thinking that was the problem.

If you were using conditional forwarding to show client IP/names on your dashboard, you can use Pi-Hole DHCP and accomplish the same thing.

Any way to use Conditional Forwarding without these queries filling everything up?

I'm seeing tons of them as well, but they stop when I turn off Conditional Forwarding, but I have an ISP router what I don't think lets me turn off DHCP.

I'm just testing something here... I had set both the WAN and LAN on my router to the Pi-Hole. Turned the WAN back to normal the queries seem to have stopped??? Do I need the WAN of the router pointing at the Pi-Hole? Seems to me like it is working.

From your results, no.

Ok thanks. The thousands of queries has stopped, and Pi-Hole still seems to be working.

However, Pi-Hole doesn't seem to see the DHCP names from my router for local devices. I guess I'll call my ISP and see if they can show me how to get into the installer side of their router and turn off their DHCP... but I'm not holding my breath.

I know this is an old post but my fix was to switch my Comcast modem into "bridge" mode. I hope this works for you since your post let me figure out why I was getting so many ptr records once every hour.

Hello @Orion_13 I ended up scrapping my ISP router as well. Bridge mode typically opens up one (or more) of your LAN ports so that you can connect a router directly to the internet and skip the ISP router. As far as I know, if you connect a computer directly to the bridged router it would be fully exposed to the internet, so just make sure you have another router if your ISP's is in bridge mode.

Sorry for this late reply. I seldom jump on here anymore since I'm not having issues like I did when I started out with pi-hole and my pi 4.

Yes you are correct bridge mode does expose everything and that was exactly what I needed and wanted. I have a router with an open source firmware running on it between me and the internet. Then I have my pi-hole doing the magic behind that. So thanks for the warning but it sure did solve a lot of issues getting that extra Comcast modem out of the way. I run security checks on open ports weekly and I've not had any surprises or unexplained network traffic in my logs.

Thanks again for the reply,
Orion

You use the pi-hole's local DNS function for this. image
I can tell you that if you have a chromium browser running, chrome, firefox, you know 90% of all browsers run chromium. If you have your pi-hole login as a shortcut on your home page and it is set to your internal dns instead of IP it will create SOA request continuously to your pi-hole. This will make your "blocked percentage" of request go way down like this.


It looks like this on your pi-hole


If you tail your ftl file you will see it is being generated from the devices you have that link on your start page. image If you edit the shortcut from http://your.dns.net/admin to the ip address it fixes this issue.
image

You probably have this fixed all ready but I thought it might help some other person in the future.