Pi-hole DNS not resolving

[Rexios]

Please follow the below template, it will help us to help you!

Expected Behaviour:

Pi-hole resolves DNS queries made by clients

Actual Behaviour:

DNS requests made to the pi-hole are not resolving

Debug Token:

a38rbm4607

[jfb]

Your debug log shows that your Pi-Hole is working properly. The problem appears to be in the configuration of your router and/or clients to use the Pi-Hole.

I would start with manually assigning the Pi-Hole as DNS on a single client, and get that client working on Pi-Hole. Then work on the router assignment to get the entire network on Pi-Hole.

How do I configure my devices to use Pi-hole as their DNS server?

Three methods Generally, there are three different methods that will enable devices on your network to be protected by Pi-hole. 1. Define Pi-hole's IP address as the only DNS entry in the router Rationale Only is italicized here for a reason: Pi-hole needs to be the only DNS server because it intercepts queries and decides whether or not they should be blocked. If you have other DNS servers configured, you may be sent to the correct domain, bypassing Pi-hole completely. Because of this, we…

[Rexios]

I have my router DNS set to be the pi-hole. When I set the DNS to the pi-hole nothing loads, but when I set it back to Cloudflare DNS everything is fine again.

[jfb]

@Rexios

When I set the DNS to the pi-hole nothing loads, but when I set it back to Cloudflare DNS everything is fine again.

Since the debug log is showing that the Pi can properly resolve queries, this is an indicator of a router problem. By manually assigning a client to Pi-Hole, you can verify that Pi-Hole is working and see the client queries populate the Pi-Hole log.

Let's do some basic troubleshooting. From a client, run the following commands and post the output:

nslookup pi-hole.net

nslookup pi-hole.net 192.168.1.94

nslookup flurry.com 192.168.1.94

From the Pi terminal run these commands and post the output:

dig pi-hole.net

dig flurry.com

[Rexios]

I set the Windows 10 machine I ran these on to use the pi-hole.

nslookup pi-hole.net

Server: raspberrypi
Address: 192.168.1.94

Non-authoritative answer:
Name: pi-hole.net
Addresses: 2604:a880:400:d0::1071:1
206.189.252.21

nslookup pi-hole.net 192.168.1.94

Server: raspberrypi
Address: 192.168.1.94

Non-authoritative answer:
Name: pi-hole.net
Addresses: 2604:a880:400:d0::1071:1
206.189.252.21

nslookup flurry.com 192.168.1.94

Server: raspberrypi
Address: 192.168.1.94

Name: flurry.com
Addresses: ::
0.0.0.0

dig pi-hole.net

; <<>> DiG 9.10.3-P4-Raspbian <<>> pi-hole.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29692
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;pi-hole.net. IN A

;; ANSWER SECTION:
pi-hole.net. 185 IN A 206.189.252.21

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Feb 18 04:11:59 GMT 2019
;; MSG SIZE rcvd: 56

dig flurry.com

; <<>> DiG 9.10.3-P4-Raspbian <<>> flurry.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31186
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;flurry.com. IN A

;; ANSWER SECTION:
flurry.com. 2 IN A 0.0.0.0

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Feb 18 04:12:17 GMT 2019
;; MSG SIZE rcvd: 55

[jfb]

What these replies tell us:

nslookup pi-hole.net - returned the correct IP, the DNS server was the Pi-Hole at IP 94. This client is using Pi-Hole as DNS server

nslookup pi-hole.net 192.168.1.94 - this lookup forced the DNS to go to the Pi-Hole, and is the same reply as the nslookup above, confirming that the Pi-Hole is working and is the default DNS for that client.

nslookup flurry.com 192.168.1.94 returned the NULL IP as expected - this is a known ad-serving domain and was blocked by Pi-Hole.

The two digs returned the correct answers, indicating that Pi-Hole is working.

@Rexios

DNS requests made to the pi-hole are not resolving

Everything we have tested so far, plus your debug log, indicates that DNS requests made to the Pi-Hole are resolving.

The problem lies in your router, by all indications.

[Rexios]

This works

This doesn't

[jfb]

This is a router problem. Check all the router settings for items like rebind protection, etc. You can try listing the Pi-Hole DNS twice, etc.

Why won't Pi-hole work with DNS rebind protection enabled?

What is DNS rebind protection? If your router has an option called DNS rebind protection enabled, you may run into issues when trying to use Pi-hole as your DNS server. The reasons for this are quite technical, but to summarize what this option does in one sentence: DNS rebind protection does not allow DNS queries to be answered with a local IP address. Why does this interfere with Pi-hole? DNS rebind is meant to be a countermeasure to an attack on your network. So in many cases, it's ac…

In the meantime, since your Pi-Hole is working, manually assign clients to use Pi-Hole as DNS while you sort out your router.

[Rexios]

I think the router has rebind protection turned on without an option to disable it (or something else is wrong). Anyway, I setup the pi-hole as a DHCP server and it's working now. Thanks for all the help!