Negative DS reply without NS record received, assuming non-DNSSEC domain-specific server.

Please follow the below template, it will help us to help you!

If you are Experiencing issues with a Pi-hole install that has non-standard elements (e.g you are using nginx, apache2 or another reverse proxy, or there is some other aspect of your install that is customised) - please use the Community Help category.

Expected Behaviour:

  • Core v6.1.2
  • FTL v6.2.2
  • Web interface v6.2.1
  • OS: Debian 12
  • VM hosted on Proxmox, and a MeLE miniPC
  • "traditional" install, not a container

There's not really an expected behavior, I'm receiving a DNSMASQ_WARN diagnosis message, and I'm unsure why it's happening. I do have a theory as to why I'm seeing it: I recently transferred my personal home domain from gandi.net to namecheap (recently as in this past weekend). On Namecheap I enabled DNSSEC, and today I saw a bunch of these warnings. This is an example of one, but there are others across both my pihole instances, each for hosts on my local network I was connecting to (SSH'ing and in web browser while performing regular system updates checks). I suspect I need to make a change somewhere so these warnings can stop, but I'm not sure what that would be, either in pihole, my Unifi setup (Dream Machine SE gateway is my DHCP provider), or on namecheap. The link to documentation didn't have anything that looked like a match, and searching on the forums for Negative DS reply without NS record received for or assuming non-DNSSEC domain-specific server. (or variations to try and catch something similar enough), the closest items didn't seem close enough to help me. I could be wrong and have misunderstood something in documentation or another forum post, though.

Actual Behaviour:

`dnsmasq` warning:

Negative DS reply without NS record received for plex.jppowers.me, assuming non-DNSSEC domain-specific server.

Debug Token:

https://tricorder.pi-hole.net/lETjTB96/

DNSSEC is a complex configuration. Simple solution is to disable DNSSEC on Namecheap.

understood, and what I was expecting to hear but figured it was worth asking to make sure I wasn't missing something simple. Appreciate it!

Sure, one of the main reasons DNSSEC is not widely deployed is the complexity and the very real chance of taking out your own zones and the difficulty in getting those zones back when the process goes wrong.