PC flooding pi-hole with DNS queries for pi.hole

Help
1

Hi,

I'm using pi-hole, with unbound, as a recursive DNS server, and as the DHCP server.

My Windows 11 PC is continually sending DNS queries for pi.hole (both IPv4 and IPv6) (about 15 every second).
The pi-hole is answering every query with the IP addresses, but the queries just continue.

I assume this behaviour isn't normal.

From the pihole log:

Jan 24 17:58:53: query[A] pi.hole from 192.168.xxx.90
Jan 24 17:58:53: Pi-hole hostname pi.hole is 192.168.xxx.66
Jan 24 17:58:53: query[A] pi.hole from 192.168.xxx.90
Jan 24 17:58:53: Pi-hole hostname pi.hole is 192.168.xxx.66
Jan 24 17:58:53: query[AAAA] pi.hole from 192.168.xxx.90
Jan 24 17:58:53: Pi-hole hostname pi.hole is fe80::xxxx:xxxx:xxxx:182d
Jan 24 17:58:53: query[A] pi.hole from 192.168.xxx.90
Jan 24 17:58:53: Pi-hole hostname pi.hole is 192.168.xxx.66
Jan 24 17:58:53: query[A] pi.hole from 192.168.xxx.90
Jan 24 17:58:53: Pi-hole hostname pi.hole is 192.168.xxx.66
Jan 24 17:58:53: query[AAAA] pi.hole from 192.168.xxx.90
Jan 24 17:58:53: Pi-hole hostname pi.hole is fe80::xxxx:xxxx:xxxx:182d
Jan 24 17:58:53: query[A] pi.hole from 192.168.xxx.90
Jan 24 17:58:53: Pi-hole hostname pi.hole is 192.168.xxx.66
Jan 24 17:58:53: query[A] pi.hole from 192.168.xxx.90
Jan 24 17:58:53: Pi-hole hostname pi.hole is 192.168.xxx.66
Jan 24 17:58:53: query[AAAA] pi.hole from 192.168.xxx.90
Jan 24 17:58:53: Pi-hole hostname pi.hole is fe80::xxxx:xxxx:xxxx:182d
Jan 24 17:58:53: query[A] pi.hole from 192.168.xxx.90
Jan 24 17:58:53: Pi-hole hostname pi.hole is 192.168.xxx.66
Jan 24 17:58:53: query[A] pi.hole from 192.168.xxx.90
Jan 24 17:58:53: Pi-hole hostname pi.hole is 192.168.xxx.66
Jan 24 17:58:53: query[AAAA] pi.hole from 192.168.xxx.90
Jan 24 17:58:53: Pi-hole hostname pi.hole is fe80::xxxx:xxxx:xxxx:182d
Jan 24 17:58:53: query[A] pi.hole from 192.168.xxx.90
Jan 24 17:58:53: Pi-hole hostname pi.hole is 192.168.xxx.66
Jan 24 17:58:53: query[A] pi.hole from 192.168.xxx.90
Jan 24 17:58:53: Pi-hole hostname pi.hole is 192.168.xxx.66
Jan 24 17:58:53: query[AAAA] pi.hole from 192.168.xxx.90
Jan 24 17:58:53: Pi-hole hostname pi.hole is fe80::xxxx:xxxx:xxxx:182d

Why is My PC doing this, and how can I stop it doing this?

2

Take a look at this free utility, it will help reveal what is making the requests on your PC.

3

Thanks.

That reveals it's Firefox making all the DNS queries. Now the question is why it's not satisfied with the result.

4

I never saw this using Firefox.

This is just a guess, but check if these queries are made from a browser extension.

1 Like
5

No.

I've worked out that tailing the pi-hole log, via the web interface, causes the 15 DNS queries every second, while just having the web interface open, causes 3 DNS queries every second.

So, monitoring the pi-hole is causing all the DNS queries!

1 Like
6

That's like some new version of "If a tree falls in a forest and no-one is around to hear it, does it make a sound"!

7

Ohhh... wait.
I think you are seeing normal requests (AJAX calls), when accessing it using pi.hole domain name.

Firefox seems to be querying the domain for every single request.

Try to access the web interface via IP. Does the number of queries drop?

8

Yes, to zero.

So, now when I tail the pihole log, it's not cluttered with DNS queries for itself.

Thanks for the question (or suggestion/idea).

9

3 posts were split to a new topic: Windows 11 Firefox sends excessive DNS requests

10

You could try below below to see if it reduces the number of queries when accessing by name instead of IP (dnsmasq is embedded into the pihole-FTL binary):

11

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.