# \[pihole\] \[unbound\] \[DNSMASQ\] validation failed: resource limit exeeded
**URL:** https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388
**Category:** Community Help
**Created:** [February 17, 2024, 9:36am UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388 "2024-02-17T09:36:29Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@the-piholer](https://discourse.pi-hole.net/u/the-piholer)
#### Post date: [February 17, 2024, 9:36am UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/1 "2024-02-17T09:36:29Z")
**The issue I am facing:**
Hello,
I got the repeatly warning of dnsmasq\_warning, that "validation of google.com failed: resource limit exceeded."
How can i proceed?
Shall i ignore the message of DNSMASQ\_core as only an DNSMASQ\_warning or how can i adjust the resource limit, so the validation will be completed?
The linked documentation didn't give me any further hint how to proceed here.
A further started google search does not give me any relatable information.
Any simply deletion of this error/warning only leads to the warning periodically reappearing in the pihole admin panel (backend).
**Details about my system:**
pihole v5.17.3 / FTL v5.25 / web interface: v5.21
OS: dietpi v9.0.2 ( debian Bullseye / Linux 6.1.21-v7+ armv7l)
raspberry pi 3B Model 4GB
**What I have changed since installing Pi-hole:**
installation and integration of unbound with official pihole/unbound tutorial found at [unbound - Pi-hole documentation](https://docs.pi-hole.net/guides/dns/unbound/)
---
### Author:  [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)
#### Post date: [February 17, 2024, 10:00am UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/2 "2024-02-17T10:00:30Z")
> [@the-piholer](#):
>
> validation of google.com failed: resource limit exceeded
> [@the-piholer](#):
>
> A further started google search does not give me any relatable information.
This is a new warning available as of FTL v5.25 building on `dnsmasq` v2.90 so it is very new and your findings here may really be the first ones on the web. This is part of the recently added protection against a DNSSEC vulnerability that could take down your Pi-hole in a denial-of-service kind of attack. More details here:
> [@Fixing two new DNSSEC vulnerabilities](https://discourse.pi-hole.net/t/fixing-two-new-dnssec-vulnerabilities/68318):
>
> Originally published at: [https://pi-hole.net/blog/2024/02/13/fixing-two-new-dnssec-vulnerabilities/](https://pi-hole.net/blog/2024/02/13/fixing-two-new-dnssec-vulnerabilities/) Today, we have been informed about two DNSSEC vulnerabilities in dnsmasq, which Pi-hole FTL is forked from. Both vulnerabilities, via specially crafted DNSSEC answers, can lead DNSSEC validators down a very CPU intensive and time costly validation/NSEC3 hash calculation path. This results in degraded performance and denial of service in trivially orchestrated attacks. In fact, the discove…
Please run
```auto
sudo kill -s SIGUSR1 $(cat /var/run/pihole-FTL.pid)
grep "DNSSEC per-" /var/log/pihole/pihole.log
```
and quote the output here. Another question: Is the `unbound` you've set up your sole upstream server?
> [@the-piholer](#):
>
> the warning periodically reappearing
Depending on the result of the commands above, we may need to increase the validation limit.
> [@the-piholer](#):
>
> The linked documentation didn't give me any further hint how to proceed here.
We need to add this, thanks for the reminder!
---
### Author:  [@the-piholer](https://discourse.pi-hole.net/u/the-piholer)
#### Post date: [February 17, 2024, 10:36am UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/3 "2024-02-17T10:36:11Z")
```auto
root@DietPi:~# sudo kill -s SIGUSR1 $(cat /var/run/pihole-FTL.pid)
root@DietPi:~# grep "DNSSEC per-" /var/log/pihole/pihole.log
Feb 17 10:32:25 dnsmasq[3008]: DNSSEC per-query subqueries HWM 10
Feb 17 10:32:25 dnsmasq[3008]: DNSSEC per-query crypto work HWM 20
Feb 17 10:32:25 dnsmasq[3008]: DNSSEC per-RRSet signature fails HWM 0
root@DietPi:~#
```
**pihole / unbound as sole DNS-upstream provider on Fritzbox**
pihole and unbound are set as the only (available) DNS-Upstream-Provider on my AVM Fritzbox 7590AX (latest OS V7.8 installed) so no DNS-request on my network setup can bypass and by accidentally answered by fritzbox as an (main / sole) router
Thank you for all of your help!
---
### Author:  [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)
#### Post date: [February 17, 2024, 3:06pm UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/4 "2024-02-17T15:06:54Z")
Interesting, please try
```auto
echo "dnssec-limits=100,1000,200,750" | sudo tee /etc/dnsmasq.d/99-dnssec-limits.conf
sudo service pihole-FTL restart
```
Whether or not the warning appears again, I'd be very interested in the output of the two commands above after some time as we may need to report upstream that the currently chosen default limits are too low.
---
### Author:  [@the-piholer](https://discourse.pi-hole.net/u/the-piholer)
#### Post date: [February 17, 2024, 4:37pm UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/5 "2024-02-17T16:37:58Z")
```auto
root@DietPi:~# echo "dnssec-limits=100,1000,200,750" | sudo tee /etc/dnsmasq.d/9 9-dnssec-limits.conf
dnssec-limits=100,1000,200,750
root@DietPi:~# sudo service pihole-FTL restart
```
---
### Author:  [@Karlo3000](https://discourse.pi-hole.net/u/Karlo3000)
#### Post date: [February 17, 2024, 5:03pm UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/6 "2024-02-17T17:03:10Z")
I've had the same problem since the last update.
Apparently it only occurs when I use unbound as an upstream server. When I enter my ISP's DNS server it doesn't seem to happen.
Raspberry Pi 3B+, Raspberry OS Lite bullseye, Pi-hole v5.17.3 FTL v5.25 Web Interface v5.21
---
### Author:  [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)
#### Post date: [February 17, 2024, 6:01pm UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/7 "2024-02-17T18:01:02Z")
@Karlo3000 Hmm, interesting. I'm running a sole `unbound` upstream as well and haven't seen it so far. Could you also try setting a higher limit using
> [@DL6ER](#):
>
> ```auto
> echo "dnssec-limits=100,1000,200,750" | sudo tee /etc/dnsmasq.d/99-dnssec-limits.conf
> sudo service pihole-FTL restart
>
> ```
and later report back to us the actual numbers found on your system
> [@DL6ER](#):
>
> ```auto
> sudo kill -s SIGUSR1 $(cat /var/run/pihole-FTL.pid)
> grep "DNSSEC per-" /var/log/pihole/pihole.log
>
> ```
?
I hope @the-piholer will keep us updated as well after some testing 🙂
Out of interest, question applying to both of you: Are you already using a version of `unbound` where said DNSSEC issue is fixed (version `1.19.1` and newer)?
---
### Author:  [@crluehmann](https://discourse.pi-hole.net/u/crluehmann)
#### Post date: [February 18, 2024, 12:39am UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/8 "2024-02-18T00:39:25Z")
> [@DL6ER](#):
>
> ```auto
> sudo kill -s SIGUSR1 $(cat /var/run/pihole-FTL.pid)
> grep "DNSSEC per-" /var/log/pihole/pihole.log
>
> ```
Saw a similar error. I'm using unbound upstream, but also a secondary pihole. Seeing these errors every 12 hours or so. Infrequently, but was curious.
I just added the dnssec-limits conf, hopefully that resolves.
After updating I grepped the pihole.log as requested above. adding my output to help the team:
Feb 17 19:37:17 dnsmasq[468554]: DNSSEC per-query subqueries HWM 6
Feb 17 19:37:17 dnsmasq[468554]: DNSSEC per-query crypto work HWM 15
Feb 17 19:37:17 dnsmasq[468554]: DNSSEC per-RRSet signature fails HWM 0
For what it's worth, it doesn't look like an unbound through version 1.19.1 is available for RaspOS on Rpi5 and apt currently only updates through unbound/stable-security,now 1.17.1-2+deb12u2 arm64.
---
### Author:  [@rdwebdesign](https://discourse.pi-hole.net/u/rdwebdesign)
#### Post date: [February 18, 2024, 1:26am UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/9 "2024-02-18T01:26:56Z")
> [@crluehmann](#):
>
> unbound/stable-security,now 1.17.1-2+deb12u2 arm64.
According to these Debian pages, version **1.17.1-2+deb12u2** has been fixed:
- [CVE-2023-50387](https://security-tracker.debian.org/tracker/CVE-2023-50387)
- [CVE-2023-50868](https://security-tracker.debian.org/tracker/CVE-2023-50868)
---
### Author:  [@crluehmann](https://discourse.pi-hole.net/u/crluehmann)
#### Post date: [February 18, 2024, 1:43am UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/10 "2024-02-18T01:43:18Z")
Thank you. That makes sense. The update to the current version was this week.
---
### Author:  [@Karlo3000](https://discourse.pi-hole.net/u/Karlo3000)
#### Post date: [February 18, 2024, 7:11am UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/12 "2024-02-18T07:11:45Z")
I'm using the last available version via apt: unbound:arm64/bullseye-security 1.13.1-1+deb11u2
After I adjusted the limits, the message appeared again after a few hours
pihole.log:
Feb 18 08:05:58 dnsmasq[37643]: DNSSEC per-query subqueries HWM 4
Feb 18 08:05:58 dnsmasq[37643]: DNSSEC per-query crypto work HWM 12
Feb 18 08:05:58 dnsmasq[37643]: DNSSEC per-RRSet signature fails HWM 0
btw: thank you for your great work and support!
---
### Author:  [@the-piholer](https://discourse.pi-hole.net/u/the-piholer)
#### Post date: [February 18, 2024, 7:34am UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/13 "2024-02-18T07:34:08Z")
Hello DL6ER
im still using: unbound Version 1.13.1 (latest given stable version of debian release bullseye on dietpi)
I set already the limit to `dnssec-limits=100,1000,200,750`
`sudo kill -s SIGUSR1 $(cat /var/run/pihole-FTL.pid)`
`grep "DNSSEC per-" /var/log/pihole/pihole.log`
**Output again**
Feb 18 07:32:04 dnsmasq[15605]: DNSSEC per-query subqueries HWM 9
Feb 18 07:32:04 dnsmasq[15605]: DNSSEC per-query crypto work HWM 26
Feb 18 07:32:04 dnsmasq[15605]: DNSSEC per-RRSet signature fails HWM 0
root@DietPi:~#
The warnings **do not** reappeared in the meantime
---
### Author:  [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)
#### Post date: [February 18, 2024, 8:47am UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/14 "2024-02-18T08:47:18Z")
Interesting! See below why. First, let's take a look at the definition of this option I wanted you to set:
> **dnssec-limits=[,.......]**
> Override the default resource limits applied to DNSSEC validation. Cryptographic operations are expensive and crafted domains can DoS a DNSSEC validator by forcing it to do hundreds of thousands of such operations. To avoid this, the dnsmasq validation code applies limits on how much work will be expended in validation. If any of the limits are exceeded, the validation will fail and the domain treated as BOGUS.
>
> There are four limits, in order(default values in parens):
>
> - number a signature validation fails per RRset(20), _[now 100]_
> - number of signature validations and hash computations per query(200), _[now 1000]_
> - number of sub-queries to fetch DS and DNSKEY RRsets per query(40), _[now 200]_ and the
> - number of iterations in a NSEC3 record(150) _[now 750]_.
>
> The maximum values reached during validation are stored, and dumped as part of the stats generated by SIGUSR1. Supplying a limit value of 0 leaves the default in place, so **--dnssec-limits=0,0,20** sets the number of sub-queries to 20 whilst leaving the other limits at default values.
Formating and comments in italics added by me.
* * *
Unfortunately, there is no logging for the last limit (NSEC3). Please run
```auto
pihole checkout ftl tweak/nsec3_iters_warning
```
and - when the warning reappears - also run
```auto
grep "NSEC3 iterations" /var/log/pihole/FTL.log
```
to confirm my theory that it is this last of the four limits that is exceeded here - even though we increased it from 150 -\> 750 already.
* * *
**IMPORTANT** Do not run this command when you are currently using the v6 beta. This branch is only meant for those currently using Pi-hole FTL v5.25 (there will be an error if you are on the v6 beta preventing your from running above's command, though).
---
### Author:  [@Karlo3000](https://discourse.pi-hole.net/u/Karlo3000)
#### Post date: [February 18, 2024, 11:07am UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/15 "2024-02-18T11:07:24Z")
The error is only triggered by one client (of about 30) - my wife's smart phone 🤭
I can reproduce the error immediately by restarting the WLAN on the smartphone.
I checked the 99-dnssec-limits.conf several times and restarted the rasperry pi.
No NSEC3 entries in FTL.log
pihole.log looks like yesterday
I'll check the log files later to see what happens when I restart the WiFi
---
### Author:  [@Karlo3000](https://discourse.pi-hole.net/u/Karlo3000)
#### Post date: [February 18, 2024, 5:47pm UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/16 "2024-02-18T17:47:18Z")
@DL6ER I have narrowed down the problem as much as I can:
- DNS1:
- Rasperry Pi 3B+, Raspberry OS Lite bullseye
- Pi-hole v5.17.3 FTL v5.25 Web Interface v5.21 / FTL tweak nsec3\_iters\_warning
- Unbound 1.13.1-1+deb11u2
- DNS2 (completely reinstalled):
- Rasperry Pi 5, Raspberry OS Lite bookworm
- Pi-hole v5.17.3 FTL v5.25 Web Interface v5.21 / FTL tweak nsec3\_iters\_warning
- Unbound 1.17.1-2+deb12u2
- The problem occurres since the last Pi-Hole update
- The problem occurs on both DNS
- The problem doesn't occur when I enter the ISP DNS in Pi-hole
- The problem appears to be caused by only one client on the network.
- The problem occurs immediately after this client logs into the WLAN, then not for a few hours
- The client is a Galaxy-A34 smartphone
- The problem is reproducible
- Adjusting the resource limits apparently has no effect on this
- So far no usable information about the 4 limits in the log files
I have now divided my network between the 2 DNS so that only the problematic smartphone uses DNS1.
After the smartphone logs into the WLAN, it takes a maximum of 5 seconds for the error to occur. The FTL.log and pihole.log are now restricted to the problem case.
Can I send you the log files somehow? Do you need any other information?
It's not that easy to get my wife's smartphone 🤣
---
### Author:  [@KeithRBrown](https://discourse.pi-hole.net/u/KeithRBrown)
#### Post date: [February 18, 2024, 6:00pm UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/17 "2024-02-18T18:00:17Z")
Hi,
I am also repeatedly receiving this warning since upgrading to FTL 5.25, but it's for a different URL (it appears to be a URL associated with my wife's employer). If there is any diagnostic information which may be of help, I'll be happy to provide.
Thanks,
Keith
---
### Author:  [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)
#### Post date: [February 18, 2024, 6:03pm UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/18 "2024-02-18T18:03:09Z")
Thanks for your further information. Even though I haven't had mich time today, I just took a quick look at the the changes that have been merged into `dnsmasq 2.90` last week and found at least one other path through which this warning might be logged incorrectly: If the upstream server replied with `REFUSED`.
Please check your `/var/log/pihole/pihole.log` at the timestamp the warning was triggered for the mentioned domain. What are the related log lines?
You should be able to find them quickly using
```auto
grep -C 20 "resource limit" /var/log/pihole/pihole.log
```
Notes: If there was a lot of activity going on, 20 may not be enough. If the event was yesterday, you may need to append `.1` to the filename.
---
### Author:  [@KeithRBrown](https://discourse.pi-hole.net/u/KeithRBrown)
#### Post date: [February 18, 2024, 6:23pm UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/19 "2024-02-18T18:23:41Z")
Hi,
I've ran the above command, which did reveal a REFUSED response...
Thanks,
Keith
---
### Author:  [@KeithRBrown](https://discourse.pi-hole.net/u/KeithRBrown)
#### Post date: [February 18, 2024, 6:28pm UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/20 "2024-02-18T18:28:19Z")
If it helps, I also generated a debug log.
Token is [https://tricorder.pi-hole.net/dFnQVqaS/](https://tricorder.pi-hole.net/dFnQVqaS/)
Thanks,
Keith
---
### Author:  [@Karlo3000](https://discourse.pi-hole.net/u/Karlo3000)
#### Post date: [February 18, 2024, 7:11pm UTC](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388/21 "2024-02-18T19:11:56Z")
Always the same 2 domains:
google.com
216.58.202.4.in-addr.arpa
[Next page](https://discourse.pi-hole.net/t/pihole-unbound-dnsmasq-validation-failed-resource-limit-exeeded/68388.md?page=2)