# Multiple PTR requests from clients and pihole

**URL:** <https://discourse.pi-hole.net/t/multiple-ptr-requests-from-clients-and-pihole/20036>\
**Category:** General\
**Created:** [May 21, 2019, 10:28am UTC](https://discourse.pi-hole.net/t/multiple-ptr-requests-from-clients-and-pihole/20036 "2019-05-21T10:28:27Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [May 21, 2019, 10:28am UTC](https://discourse.pi-hole.net/t/multiple-ptr-requests-from-clients-and-pihole/20036/1 "2019-05-21T10:28:28Z")

</div>

I've noticed recently that there are a lot of PTR queries in my log, and I am not sure what they are, or why I now suddenly see them?  
for example:

```auto
May 21 00:00:46 dnsmasq[3830]: query[PTR] 36.210.58.216.in-addr.arpa from 192.168.0.142
May 21 00:00:46 dnsmasq[3830]: forwarded 36.210.58.216.in-addr.arpa to 1.0.0.1
May 21 00:00:46 dnsmasq[3830]: dnssec-query[DS] 210.58.216.in-addr.arpa to 1.0.0.1
May 21 00:00:46 dnsmasq[3830]: reply 210.58.216.in-addr.arpa is no DS
May 21 00:00:46 dnsmasq[3830]: validation result is INSECURE
May 21 00:00:46 dnsmasq[3830]: reply 216.58.210.36 is lhr25s11-in-f4.1e100.net
May 21 00:00:46 dnsmasq[3830]: reply 216.58.210.36 is lhr25s11-in-f4.1e100.net
May 21 00:00:46 dnsmasq[3830]: reply 216.58.210.36 is lhr25s11-in-f36.1e100.net
May 21 00:00:46 dnsmasq[3830]: reply 216.58.210.36 is lhr25s11-in-f36.1e100.net

```

However, I also see PTR queries at semi-regular intervals from the pi-hole itself:

```auto
May 21 03:00:00 dnsmasq[3830]: query[PTR] 100.0.168.192.in-addr.arpa from 127.0.0.1
May 21 03:00:00 dnsmasq[3830]: DHCP 192.168.0.100 is rich-phone.local
May 21 03:00:00 dnsmasq[3830]: query[PTR] 142.0.168.192.in-addr.arpa from 127.0.0.1
May 21 03:00:00 dnsmasq[3830]: DHCP 192.168.0.142 is philips-tv.local
May 21 03:00:00 dnsmasq[3830]: query[PTR] 191.0.168.192.in-addr.arpa from 127.0.0.1
May 21 03:00:00 dnsmasq[3830]: DHCP 192.168.0.191 is HarmonyHub.local
May 21 03:00:00 dnsmasq[3830]: query[PTR] 128.0.168.192.in-addr.arpa from 127.0.0.1
May 21 03:00:00 dnsmasq[3830]: DHCP 192.168.0.128 is sky-box.local
May 21 03:00:00 dnsmasq[3830]: query[PTR] 111.0.168.192.in-addr.arpa from 127.0.0.1
May 21 03:00:00 dnsmasq[3830]: DHCP 192.168.0.111 is sonoff-sensor-node-lounge.local
May 21 03:00:00 dnsmasq[3830]: query[PTR] 48.0.168.192.in-addr.arpa from 127.0.0.1
May 21 03:00:00 dnsmasq[3830]: DHCP 192.168.0.48 is sonoff1-bedside-lamp.local
May 21 03:00:00 dnsmasq[3830]: query[PTR] 163.0.168.192.in-addr.arpa from 127.0.0.1
May 21 03:00:00 dnsmasq[3830]: DHCP 192.168.0.163 is sonoff-sensor-node-bedroom.local
May 21 03:00:00 dnsmasq[3830]: query[PTR] 3.0.168.192.in-addr.arpa from 127.0.0.1
May 21 03:00:00 dnsmasq[3830]: DHCP 192.168.0.3 is rich-laptop.local
May 21 03:00:00 dnsmasq[3830]: query[PTR] 1.0.0.1.in-addr.arpa from 127.0.0.1
May 21 03:00:01 dnsmasq[3830]: forwarded 1.0.0.1.in-addr.arpa to 1.0.0.1
May 21 03:00:01 dnsmasq[3830]: validation result is INSECURE
May 21 03:00:01 dnsmasq[3830]: reply 1.0.0.1 is one.one.one.one
May 21 03:00:01 dnsmasq[3830]: query[PTR] 1.1.1.1.in-addr.arpa from 127.0.0.1
May 21 03:00:01 dnsmasq[3830]: forwarded 1.1.1.1.in-addr.arpa to 1.0.0.1
May 21 03:00:01 dnsmasq[3830]: validation result is INSECURE
May 21 03:00:01 dnsmasq[3830]: reply 1.1.1.1 is one.one.one.one

```

If I understand fully, the queries from Pihole are asking for the device names?  
But im not sure why, for example client 192.168.0.142 is making the queries all of a sudden (its a Philips smart TV), what does the `insecure` validation result mean?  
Im a little concerned / confused as to what is happening here.  
I ran `pihole -d`, but when I choose yes to upload to tricorder, I receive an error message:  
`There was an error uploading your debug log`  
Also been having problems with my [unbound install](https://discourse.pi-hole.net/t/query-results-come-back-as-bogus-servfail/19450/157), could there be any relation?  
No changes to hardware, or setup etc, and I update to latest Pi-hole yesterday, along with a `sudo apt update && sudo apt upgrade`  
Only update I have not done is `dist-upgrade`

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [May 21, 2019, 3:52pm UTC](https://discourse.pi-hole.net/t/multiple-ptr-requests-from-clients-and-pihole/20036/2 "2019-05-21T15:52:01Z")

</div>

> [@Valiceemo](#):
>
> But im not sure why, for example client 192.168.0.142 is making the queries all of a sudden (its a Philips smart TV), what does the `insecure` validation result mean?

This IP (216.58.210.36) is registered to Google, so some function of the device wants to know the name of that IP address.

```auto
NetRange: 216.58.192.0 - 216.58.223.255
CIDR: 216.58.192.0/19
NetName: GOOGLE
NetHandle: NET-216-58-192-0-1
Parent: NET216 (NET-216-0-0-0-0)
NetType: Direct Allocation
OriginAS: AS15169
Organization: Google LLC (GOGL)
RegDate: 2012-01-27
Updated: 2012-01-27
Ref: https://rdap.arin.net/registry/ip/216.58.192.0

OrgName: Google LLC
OrgId: GOGL
Address: 1600 Amphitheatre Parkway
City: Mountain View
StateProv: CA
PostalCode: 94043
Country: US
RegDate: 2000-03-30
Updated: 2018-10-24

```

Using unbound for a reverse dig:

```auto
dig -x 216.58.210.36

; <<>> DiG 9.10.3-P4-Raspbian <<>> -x 216.58.210.36
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16966
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;36.210.58.216.in-addr.arpa. IN PTR

;; ANSWER SECTION:
36.210.58.216.in-addr.arpa. 86400 IN PTR lhr25s11-in-f4.1e100.net.
36.210.58.216.in-addr.arpa. 86400 IN PTR lhr25s11-in-f36.1e100.net.
36.210.58.216.in-addr.arpa. 86400 IN PTR lhr25s11-in-f36.1e100.net.
36.210.58.216.in-addr.arpa. 86400 IN PTR lhr25s11-in-f4.1e100.net.

;; Query time: 983 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue May 21 10:50:03 CDT 2019
;; MSG SIZE rcvd: 151

```

Do you have DNSSEC enabled on your Pi-Hole? If so, disable that, as it is not needed when you do DNSSEC with unbound.

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [May 21, 2019, 4:11pm UTC](https://discourse.pi-hole.net/t/multiple-ptr-requests-from-clients-and-pihole/20036/3 "2019-05-21T16:11:42Z")

</div>

Interesting that my TV is querying Google?!  
Why are they showing as `PTR` requests?  
I've never seen this before.

In regards to unbound, I disabled DNSSEC (unticked the box) and set a custom DNS as per the guide, and I see constant `SERVFAIL` errors, effectively rendering my internet connection dead.  
If I choose 'regular' upstream DNS servers, such as Cloudflare and _enable_ DNSSEC, everything works as expected.  
If I use a custom DNS in pihole settings, and add the below to unbound config, it works. No errors

```auto
forward-zone:
    name: "."
    forward-addr: 1.1.1.1
    forward-addr: 1.0.0.1

```

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [May 21, 2019, 4:27pm UTC](https://discourse.pi-hole.net/t/multiple-ptr-requests-from-clients-and-pihole/20036/4 "2019-05-21T16:27:17Z")

</div>

> [@Valiceemo](#):
>
> Why are they showing as `PTR` requests?

The TV isn't querying Google (as in "get me the IP address of google.com"), it is looking for the name of the domain at the IP address shown in the PTR request.

TV's generally have poorly implement OS, so it's hard to say why the TV is looking for this information.

> [@jfb](#):
>
> what does the `insecure` validation result mean?

> [@How do I interperet the DNSSEC column in the query log?](https://discourse.pi-hole.net/t/how-do-i-interperet-the-dnssec-column-in-the-query-log/7185):
>
> As of Pi-hole 3.3, you can see the DNSSEC status in the query log. [40] SECURE are records that have been signed and verified to be unchanged from the authoritative DNS server INSECURE are records that either have no signature or DNSSEC is not implemented for the domain; either the domain is unsigned and not implementing DNSSEC or there are other issues BOGUS are records that have been signed but have changed or been altered from the authoritative DNS server You will see INSECURE, but that d…

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [May 21, 2019, 4:37pm UTC](https://discourse.pi-hole.net/t/multiple-ptr-requests-from-clients-and-pihole/20036/5 "2019-05-21T16:37:25Z")

</div>

Typically what a pointer record helps with is a client that has an IP address that it knows, like 8.8.8.8, but needs to be able to display the name for the user to see, like google.com. PTRs are reversed because the process is reversed, instead of knowing a domain name and looking for the IP, it knows the IP and needs to find the domain name.

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [May 21, 2019, 6:04pm UTC](https://discourse.pi-hole.net/t/multiple-ptr-requests-from-clients-and-pihole/20036/6 "2019-05-21T18:04:08Z")

</div>

Ah ok, makes sense on the TV, the os is rather clunky.  
Why would pihole all of a sudden need to start querying the names of my clients? All have static ips assigned, with pihole acting as DHCP.

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [May 21, 2019, 6:08pm UTC](https://discourse.pi-hole.net/t/multiple-ptr-requests-from-clients-and-pihole/20036/7 "2019-05-21T18:08:46Z")

</div>

They most likely have always been happening on the network, it wasn't until a recent release that we actually displayed the queries. Previously we only displayed A and AAAA queries.

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [May 21, 2019, 7:48pm UTC](https://discourse.pi-hole.net/t/multiple-ptr-requests-from-clients-and-pihole/20036/8 "2019-05-21T19:48:00Z")

</div>

Ah ok, did not know that! Did it not log them at all. Anywhere?  
Any thoughts on the unbound issue?

---

<div class="post-metadata">

**Author:** ![Mcat12](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mcat12/32/20_2.png) [@Mcat12](https://discourse.pi-hole.net/u/Mcat12)\
**Post date:** [May 22, 2019, 3:02am UTC](https://discourse.pi-hole.net/t/multiple-ptr-requests-from-clients-and-pihole/20036/9 "2019-05-22T03:02:18Z")

</div>

The non-A or AAAA queries were not processed by FTL, but were still resolved by dnsmasq. I don't use unbound, so not sure about that issue.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [May 22, 2019, 3:22am UTC](https://discourse.pi-hole.net/t/multiple-ptr-requests-from-clients-and-pihole/20036/10 "2019-05-22T03:22:18Z")

</div>

> [@Valiceemo](#):
>
> Also been having problems with my [unbound install](https://discourse.pi-hole.net/t/query-results-come-back-as-bogus-servfail/19450/157), could there be any relation?

I don't think so. Your unbound installation is not working, but this is a separate piece of software from Pi-Hole and unrelated to your PTR requests.

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [May 22, 2019, 8:56am UTC](https://discourse.pi-hole.net/t/multiple-ptr-requests-from-clients-and-pihole/20036/11 "2019-05-22T08:56:31Z")

</div>

OK, I guess the last thing I can try is a `dist-upgrade`  
Failing that I will revert back to using the standard upstreams.