# not able to resolve 1 specific domain 

**URL:** <https://discourse.pi-hole.net/t/not-able-to-resolve-1-specific-domain/79912>\
**Category:** Help\
**Created:** [May 16, 2025, 10:54pm UTC](https://discourse.pi-hole.net/t/not-able-to-resolve-1-specific-domain/79912 "2025-05-16T22:54:08Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fons\_Knaapen](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/fons_knaapen/32/15351_2.png) [@Fons\_Knaapen](https://discourse.pi-hole.net/u/Fons_Knaapen)\
**Post date:** [May 16, 2025, 10:54pm UTC](https://discourse.pi-hole.net/t/not-able-to-resolve-1-specific-domain/79912/1 "2025-05-16T22:54:09Z")

</div>

Recently I discovered a rather interesting but also somewhat annoying issue with my pihole. Exactly one domain (odido.nl) is not resolving and that is the domain of my internet provider.

## Expected Behaviour: When I type www.odido.nl or just odido.nl in my browser I expect to go to the website.

Pihole + Unboud is on my headless Pi4B with 8GB mem, installed from DietPi's menu. It is updated to the latest version, is the sole DNS in my network set in my router and its IP address is fixed. IPv6 is off (on the whole network, including my router). From HTOP: mem usage is 327M/7.680, load avarage is \<= 0.15. I have no other noticable (DNS) issues in my network, speed is a solid 100Mbit/100Mbit on fiber.

## Actual Behaviour:

So, on any Windows PC (all wired) or Android device (wireless) on the network, this particular domain does not resolve.  
Tested:

- change windows network adapter settings to a fixed DNS 1.1.1.1 or
- switch off WiFi and use mobile data on my Android device or
- use terminal on the Pi4B to ping the domain  
all results in the domain being resolved and accessable.  
However:
- manually adding the domain as an allowed domain in pihole or
- disable blocking from the web ui or
- use Windows terminal to ping or
- use a terminal on another Pi3B in my network to ping or nslookup  
all results in the domain still not being resolved.

To me it's weird because if this domain was somewhere in a gravity list than disabling blocking would allow the domain to be resolved, but it isn't.

## Debug Token: [https://tricorder.pi-hole.net/c08PKyEk/](https://tricorder.pi-hole.net/c08PKyEk/)

---

<div class="post-metadata">

**Author:** ![rdwebdesign](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/rdwebdesign/32/51363_2.png) [@rdwebdesign](https://discourse.pi-hole.net/u/rdwebdesign)\
**Post date:** [May 16, 2025, 11:00pm UTC](https://discourse.pi-hole.net/t/not-able-to-resolve-1-specific-domain/79912/2 "2025-05-16T23:00:25Z")

</div>

> [@Fons\_Knaapen](#):
>
> To me it's weird because if this domain was somewhere in a gravity list than disabling blocking would allow the domain to be resolved

This is almost correct, but the domain resolution depends on the upstream DNS server.

You know `1.1.1.1` is correctly resolving the domain, but your Pi-hole is using a different upstream (Unbound).

From the Pi4B command line, what is the output of this command?

```auto
nslookup -port=5335 www.odido.nl 127.0.0.1

```

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [May 17, 2025, 6:41am UTC](https://discourse.pi-hole.net/t/not-able-to-resolve-1-specific-domain/79912/3 "2025-05-17T06:41:08Z")

</div>

> [@Fons\_Knaapen](#):
>
> Exactly one domain (oido.nl) is not resolving and that is the domain of my internet provider.

[`www.odido.nl`'s zone configuration](https://dnsviz.net/d/www.odido.nl/dnssec/?rr=all&a=all&ds=all&doe=on&ta=.&tk=) seems faulty. Apparently, it is announcing support for a specific signing algorithm, but not supplying actual data:

 ![dnsviz.odido-nl](https://discourse-cdn.pi-hole.net/uploads/default/original/3X/0/3/03522c8c2caf6fe56b2564bdfda0b2ab20255c56.png)

Likely, that incorrect configuration results in _`unbound`_ failing to validate signed DNS records for `odido.nl` via DNSSEC.

This has to be fixed by the domain's maintainer.

---

<div class="post-metadata">

**Author:** ![Fons\_Knaapen](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/fons_knaapen/32/15351_2.png) [@Fons\_Knaapen](https://discourse.pi-hole.net/u/Fons_Knaapen)\
**Post date:** [May 17, 2025, 6:54am UTC](https://discourse.pi-hole.net/t/not-able-to-resolve-1-specific-domain/79912/4 "2025-05-17T06:54:30Z")

</div>

> [@rdwebdesign](#):
>
> `nslookup -port=5335 www.odido.nl 127.0.0.1`

Thank you. This is the response to that

;; Got SERVFAIL reply from 127.0.0.1  
Server: 127.0.0.1  
Address: 127.0.0.1#5335

\*\* server can't find www.odido.nl: SERVFAIL

but 'nslookup www.odido.nl' results in this:

Server: 37.143.84.228  
Address: 37.143.84.228#53

---

<div class="post-metadata">

**Author:** ![Fons\_Knaapen](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/fons_knaapen/32/15351_2.png) [@Fons\_Knaapen](https://discourse.pi-hole.net/u/Fons_Knaapen)\
**Post date:** [May 17, 2025, 7:05am UTC](https://discourse.pi-hole.net/t/not-able-to-resolve-1-specific-domain/79912/5 "2025-05-17T07:05:22Z")

</div>

Thank you. Not sure I understand that picture, way over my head I guess 🙂 If I understand correctly, this would effect all Odido customers who also use Unbound, right? With around 8 million customers I should be able to find others with the same issue then, I'll see if I can find any.

Is there any way to confirm or test that Unbound has problems with that faulty zone configuration, outside of my Pihole/Pi4B, or is that nslookup the only way?

---

<div class="post-metadata">

**Author:** ![Fons\_Knaapen](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/fons_knaapen/32/15351_2.png) [@Fons\_Knaapen](https://discourse.pi-hole.net/u/Fons_Knaapen)\
**Post date:** [May 17, 2025, 7:13am UTC](https://discourse.pi-hole.net/t/not-able-to-resolve-1-specific-domain/79912/6 "2025-05-17T07:13:55Z")

</div>

Also tested this:

- checked the PI4 Cloudflare boxes in the Web UI to see if that resolves anything but it doesn't. It does show the IP addresses in the 'custom dns' box, but still doesn't resolve the domain.
- ran 'pihole reloaddns' from a terminal but still no success.

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [May 17, 2025, 7:14am UTC](https://discourse.pi-hole.net/t/not-able-to-resolve-1-specific-domain/79912/7 "2025-05-17T07:14:08Z")

</div>

> [@Fons\_Knaapen](#):
>
> Exactly one domain (oido.nl) is not resolving and that is the domain of my internet provider.

> [@Bucking\_Horn](#):
>
> This has to be fixed by the domain's maintainer.

As that domain belongs to your ISP, you could approach your ISP with the findings of DNSViz's DNSSEC validator, by including the link I've posted above, and ask them to address the errors it found.

---

<div class="post-metadata">

**Author:** ![Fons\_Knaapen](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/fons_knaapen/32/15351_2.png) [@Fons\_Knaapen](https://discourse.pi-hole.net/u/Fons_Knaapen)\
**Post date:** [May 17, 2025, 7:18am UTC](https://discourse.pi-hole.net/t/not-able-to-resolve-1-specific-domain/79912/8 "2025-05-17T07:18:14Z")

</div>

Thank you. I will do that but first I'll try to find others with the same issue as I anticipate no (helpful) response from my provider if I'm the only one reporting this 🙂

Which is hampered by the fact I can't reach their supportpages as those are under that domain .... 🤣

---

<div class="post-metadata">

**Author:** ![Fons\_Knaapen](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/fons_knaapen/32/15351_2.png) [@Fons\_Knaapen](https://discourse.pi-hole.net/u/Fons_Knaapen)\
**Post date:** [May 17, 2025, 7:39am UTC](https://discourse.pi-hole.net/t/not-able-to-resolve-1-specific-domain/79912/9 "2025-05-17T07:39:46Z")

</div>

So, I did find a forum thread with others who have that same issue starting back from april 17 2025, confirming that DNSviz report. There, solutions are provided with a change in unbound.conf: 'harden-algo-downgrade: no' that would effectively mean something like 'if alg 13 is okay then ignore alg 8'. And then the thread continious with lots more changes that I don't understand 🤣

I'll report this to my provider and link the forum post that shows it is actually an issue with them, with the zone configuration, and see if that resolves anything.

Edit: I found 1 other report of this at my provider from 29 days ago but no reply there, unfortunately. Sent a report myself as well. The Dutch forum thread that also provides a soluition: [https://gathering.tweakers.net/forum/list\_messages/1844277?data[filter\_keywords]=odido](https://gathering.tweakers.net/forum/list_messages/1844277?data%5Bfilter_keywords%5D=odido)

I think this topic can be closed.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [June 7, 2025, 7:39am UTC](https://discourse.pi-hole.net/t/not-able-to-resolve-1-specific-domain/79912/10 "2025-06-07T07:39:58Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.