Pihole+Unbound rclone+onedrive

graph.microsoft.com turning up as the most requested domain would support that your rclone's DNS requests are subject to Pi-hole's rate limit (as introduced by Pi-hole's FTL v5.7).

Note that contrary to the opinion from the post you've linked, this is a client issue.
It is a client that decides to send a DNS request, and when and how often it does so.

`dig` returns a TTL of 4 hours for the `graph.microsoft.com` CNAME and of 5 minutes for the respective A records that it points to (click for details).
~$ dig graph.microsoft.com

; <<>> DiG 9.11.5-P4-5.1+deb10u3-Debian <<>> graph.microsoft.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63530
;; flags: qr rd ra; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;graph.microsoft.com.           IN      A

;; ANSWER SECTION:
graph.microsoft.com.    14400   IN      CNAME   ags.privatelink.msidentity.com.
ags.privatelink.msidentity.com. 300 IN  CNAME   www.tm.prd.ags.trafficmanager.net.
www.tm.prd.ags.trafficmanager.net. 300 IN A     40.126.32.99
www.tm.prd.ags.trafficmanager.net. 300 IN A     20.190.160.25
www.tm.prd.ags.trafficmanager.net. 300 IN A     20.190.160.24
www.tm.prd.ags.trafficmanager.net. 300 IN A     20.190.160.97
www.tm.prd.ags.trafficmanager.net. 300 IN A     20.190.160.96
www.tm.prd.ags.trafficmanager.net. 300 IN A     20.190.160.164

;; Query time: 351 msec
;; SERVER: 192.168.1.2#53(192.168.1.2)
;; WHEN: Mon Aug 30 20:53:49 CEST 2021
;; MSG SIZE  rcvd: 232

A sensible approach for a client would be to keep working with an IP address until its TTL expires.
A client respecting that TTL would thus end up sending a new DNS query every 5 minutes, totalling to 12 DNS requests per hour, or 288 per day.
This would be far below Pi-hole's rate limit default of 1,000 DNS request per minute per client (equaling 60,000 per hour or 1,4 million DNS queries a day).

Based on your link, it seems a fair assumption that rclone is exceeding that limit.

Note that you may run into the same observation with other DNS servers as well, as rate limiting DNS requests is common practice for DNS servers (e.g. its around 1,500 queries per second per source IP for Google's DNS servers).

The most effective way to address your issue would be to
(i) find a way to stop rclone from sending such a large amount of unnecessary DNS requests.

You'd have to consult rclone's documentation and support in order to find out if and how that's supported.

If it isn't supported, you'd have two other options:
(ii) Install or enable a caching DNS stub resolver that uses Pi-hole as its only upstream on the client system that runs rclone.

While rclone would still send over thousand identical DNS requests per second, those would hit the stub resolver's cache on the same system before they hit Pi-hole over the network, i.e. the stub resolver would query Pi-hole once every 5 minutes and serve all other requests by rclone for the same domain from its cache.
This has the additional advantage of working with other DNS servers as well, and it should be also a tad bit faster than wiring all queries to Pi-hole.

(iii) Set Pi-hole's RATE_LIMIT to a higher value or disable it completely

See Pi-hole's documentation on Query Rate Limiting for details.

After you made your changes to /etc/pihole/pihole-FTL.conf, don't forget to restart Pi-hole's DNS resolver to apply them, e.g. by running

pihole restartdns
1 Like