# Pi-Hole doesn´t use the DNS Cache with DNSSEC enabled. Why?

**URL:** <https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271>\
**Category:** Help\
**Created:** [February 13, 2019, 9:12pm UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271 "2019-02-13T21:12:38Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nachtwesen](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/f17d59/32.png) [@Nachtwesen](https://discourse.pi-hole.net/u/Nachtwesen)\
**Post date:** [February 13, 2019, 9:12pm UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271/1 "2019-02-13T21:12:38Z")

</div>

Hi again.

I noticed that my Pi-Hole does not use any entries in the cache.

DNS cache size: 10000  
DNS cache insertions: 0  
DNS cache evictions: 0

In the beginning, that still worked, not anymore. Does anyone have any idea why this might be? DNSSEC is enabled. Unfortunately pihole -r and Co. did not help. Or is the behavior normal?

**Token:** Since I currently have another problem, a token will lure you on the wrong track, which is why I have not added any here.

Thank you very much.

---

<div class="post-metadata">

**Author:** ![mibere](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mibere/32/18057_2.png) [@mibere](https://discourse.pi-hole.net/u/mibere)\
**Post date:** [February 13, 2019, 9:17pm UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271/2 "2019-02-13T21:17:34Z")

</div>

Had the same problem with v4.1.2 and enabled DNSSEC, and still have with v4.2.1.  
I have DNSSEC disabled now ☹

> [@Cache issue with v4.1.2?](https://discourse.pi-hole.net/t/cache-issue-with-v4-1-2/15437):
>
> I'm on Pi-hole Version v4.1.1 Web Interface Version v4.1.1 FTL Version v4.1.2 Is there a known cache issue? The command dig +short chaos txt insertions.bind returns 0 even after hours. Even 'DNS cache insertions' in the Web UI keeps on 0 (clearing browser cache doesn't help) and also the graph on the Dashboard is abnormal regarding "Queries answered by Cache". A restart of the Pi doesn't change anything. I'm not sure, but there was no problem with v4.1.1.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [February 13, 2019, 10:50pm UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271/3 "2019-02-13T22:50:21Z")

</div>

As noted above by @mibere there have been problems with cache and DNSSEC.

Which upstream DNS servers are you using, and can you disable DNSSEC and see if the problem resolves?

---

<div class="post-metadata">

**Author:** ![Nachtwesen](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/f17d59/32.png) [@Nachtwesen](https://discourse.pi-hole.net/u/Nachtwesen)\
**Post date:** [February 14, 2019, 6:58am UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271/4 "2019-02-14T06:58:04Z")

</div>

Thanks for your answers.

I use AS250.net Foundation ([https://as250.net/](https://as250.net/)) as Upstream.  
Test it without DNSSEC when I am home again.

---

<div class="post-metadata">

**Author:** ![Nachtwesen](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/f17d59/32.png) [@Nachtwesen](https://discourse.pi-hole.net/u/Nachtwesen)\
**Post date:** [February 14, 2019, 12:43pm UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271/5 "2019-02-14T12:43:38Z")

</div>

Yes, without DNSSEC the DNS Cache is working.  
Are the devs working on this issue?

---

<div class="post-metadata">

**Author:** ![Mcat12](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mcat12/32/20_2.png) [@Mcat12](https://discourse.pi-hole.net/u/Mcat12)\
**Post date:** [February 15, 2019, 3:49am UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271/6 "2019-02-15T03:49:18Z")

</div>

DNSSEC and the DNS cache are implemented by dnsmasq. If there's a bug in those areas, it is a dnsmasq bug, not a Pi-hole bug.

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [February 24, 2019, 11:33am UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271/7 "2019-02-24T11:33:47Z")

</div>

Can you run `pihole checkout ftl hotfix/v4.2.3` and see if that allows cache again with DNSSEC. I've just tried and it looks like cache is working again with DNSSEC enabled.

---

<div class="post-metadata">

**Author:** ![Nachtwesen](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/f17d59/32.png) [@Nachtwesen](https://discourse.pi-hole.net/u/Nachtwesen)\
**Post date:** [February 26, 2019, 6:18pm UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271/8 "2019-02-26T18:18:54Z")

</div>

@DanSchaper Hi! Thanks for your answer. I updated to 4.2.3 but that changes nothing.

DNS cache insertions: 0

Sure, I surfed a little bit!

Without DNSSEC works instantly. You have any news about this?

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [February 26, 2019, 7:10pm UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271/9 "2019-02-26T19:10:02Z")

</div>

![Screenshot%20from%202019-02-26%2011-09-03](https://discourse.pi-hole.net/uploads/default/original/2X/f/fdd0e93971546194e54f5f5f979b9647c58f5b29.png) ![Screenshot%20from%202019-02-26%2011-09-37](https://discourse.pi-hole.net/uploads/default/original/2X/a/a983879683f02c28b41d4dabc243abb9a7fa89d7.png)

---

<div class="post-metadata">

**Author:** ![Nachtwesen](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/f17d59/32.png) [@Nachtwesen](https://discourse.pi-hole.net/u/Nachtwesen)\
**Post date:** [February 26, 2019, 7:18pm UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271/10 "2019-02-26T19:18:05Z")

</div>

@DanSchaper

 ![php](https://discourse.pi-hole.net/uploads/default/original/2X/5/58add965a59d3510e2c6de05b9183e9154000581.png)  
 ![php_tab%3Ddns](https://discourse.pi-hole.net/uploads/default/original/2X/5/526c788ef1a86ebcedb33f71af66b357ba60db79.png)

My used DNS is AS250.net with full DNSSEC support. The DNS server is the only difference I can see.

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [February 26, 2019, 7:23pm UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271/11 "2019-02-26T19:23:35Z")

</div>

Try using another upstream as a test, I tried with your upstream and saw the same no cache issue. Since this is related to the upstream and not FTL I don't think this is a bug with our package.

---

<div class="post-metadata">

**Author:** ![Nachtwesen](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/f17d59/32.png) [@Nachtwesen](https://discourse.pi-hole.net/u/Nachtwesen)\
**Post date:** [February 26, 2019, 7:39pm UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271/12 "2019-02-26T19:39:53Z")

</div>

@DanSchaper Jep its the upstream server. With Quad9 it works as you said.

Thats good news, but bad news for me. I loved my upstream :(.

Thank you very much for your help and the great work.

---

<div class="post-metadata">

**Author:** ![mibere](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mibere/32/18057_2.png) [@mibere](https://discourse.pi-hole.net/u/mibere)\
**Post date:** [February 26, 2019, 7:45pm UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271/13 "2019-02-26T19:45:07Z")

</div>

Do you have an idea why it's an issue with some upstream, why it's working with one but not with the other? I ask because my own upstream is affected too - no caching with enabled DNSSEC in Pi-hole v4.2.3.

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [February 26, 2019, 10:07pm UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271/14 "2019-02-26T22:07:04Z")

</div>

I'll have to check and see if I can find any differences in the payload from the various upstreams. When I get a chance I'll run tcpdump and watch the upstream queries and responses. As Mark pointed out if there are bugs it's most likely to be in the `dnsmasq` code base as we don't change anything in there.

If you wanted to run pure `dnsmasq` 2.80 and run `dig +short chaos txt cachesize.bind insertions.bind` with your preferred upstream that would help, it make take a bit of time before I can try that.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [March 19, 2019, 10:07pm UTC](https://discourse.pi-hole.net/t/pi-hole-doesn-t-use-the-dns-cache-with-dnssec-enabled-why/17271/15 "2019-03-19T22:07:08Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.