PiHole v6 and Top Client pi.hole (DNSSEC Entries) with unbound

[its]

Hi All

Reading a few older posts

Top Client is "::"

I have had those for a while as well. I believe they are pi-hole itself, using IPV6 internally, to resolve DS and DNSKEY queries. I have IPV6 disabled, via net.ipv6.conf options but pi-hole still listens on tcp6 0 0 [::]:domain [::]:* LISTEN apparently and can respond to its own queries. I haven't found any decent way of disabling the IPV6 stack other than a kernel option nor have I found a way to enter a hosts entry for the 'all zero' IPV6 address.

Pi.hole client in Query log

Please follow the below template, it will help us to help you! If you are Experiencing issues with a Pi-hole install that has non-standard elements (e.g you are using nginx instead of lighttpd, or there is some other aspect of your install that is customised) - please use the Community Help category. Expected Behaviour: pi-hole should not query web addresses as a client. Actual Behaviour: I have a question about something I start noticing in Pi-hole Query Log, what does it mean when pi.hol…

In Pi-hole 6 - is this the still way to stop this?

set SHOW_DNSSEC=false in /etc/pihole/pihole-FTL.conf

Per above reading it says that

The number of queries will quickly drop afterwards when the chain has been primed with all the top-level domains you are typically visiting.

But mine is consistently at the top of the list and I can see for example a domain entry repeating nearly 200 times in last 24 hrs.. So is caching not working or something else?

Example entry for that domain

Query received on: XXXXX
Client: pi.hole (:: )
Query Status: Forwarded, reply from 192.168.1.1#5335
Reply: NODATA
Database ID: 713547

Something not working in unbound? how can I check and solve this?

Thanks

[CallMeCurious]

You will want to run a sudo pihole -d and provide the devs with a token and maybe some clarity on what you ran to produce your example output?

[its]

@CallMeCurious Didn't run anything to produce the output.. its copied from the UI when you click on any domain name on the client search

Debug Token: https://tricorder.pi-hole.net/7tRxXvcj/

PS: Why is the debug page been removed from v6? Was much easier on UI then logging into docker

[CallMeCurious]

Just for my curiousity, is 192.168.1.1 your router or the pi? I'm not sure why it would show 192.168.1.1#5335 when unbound would normally listen on localhost#5335

[its]

192.168.1.1 is my NAS where docker is running and both pihole and unbound is running.. Its probably because of my docker-compose file entry of FTLCONF_dns_upstreams

Could be wrong.. Happy to change anything here not needed and rebuild

version: '3'

services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    hostname: pihole
    network_mode: host  # Use host networking mode
    cap_add:
      - SYS_TIME
      - SYS_NICE
    environment:
      TZ: 'XXXX'                       # Timezone setting
      FTLCONF_webserver_api_password: 'XXXX'        # Change this to your desired password
      FTLCONF_webserver_port: '8079'			          # Port
      FTLCONF_dns_dnssec: 'true'                      # Enable DNSSEC
      FTLCONF_dns_listeningMode: 'all'                # Ensure dnsmasq listens to all interfaces
      FTLCONF_dns_upstreams: '192.168.1.1#5335'         # Unbound upstream DNS
    volumes:
      - '/docker/pihole-6/pihole:/etc/pihole:rw'
      - '/docker/pihole-6/pihole/hosts/hosts:/etc/hosts:rw'
    restart: always
    depends_on:
      - unbound

  unbound:
    image: mvance/unbound:latest
    container_name: unbound
    ports:
      - "5335:53/tcp"
      - "5335:53/udp"
    volumes:
      - '/docker/pihole-6/unbound:/etc/unbound'  # Change to your volume path
    restart: always

[CallMeCurious]

No clue on Docker as I don't use it but its an important thing for the devs to know.