Rate limit due to openthread queries

If you can't find a way to stop the queries from the device, you can lift the rate-limit by by setting RATE_LIMIT=0/0 in /etc/pihole/pihole-FTL.conf followed by pihole restartdns

https://docs.pi-hole.net/ftldns/configfile/#rate_limit

From your screen shot, Pi-hole is not blocking this. The query was forwarded to your upstream DNS resolver, which was unable to resolve it.

Another option (rather than removing the rate limit for the entire Pi-hole), is to assign a different DNS to the Apple TV and you won't see any of the queries in Pi-hole.

Same problem with me. I have several HomePod Minis. They spam my network with requests. SERVFAIL as response. Is there no reasonable solution here, it must be virtually all users with newer Apple devices affected. The behavior seems to occur as of iOS 15.2.

They aren't spamming your network. This appears to be normal traffic for the HomePod devices. I don't see any of these queries with any of my Apple devices, but I don't have HomePods.

For me the suggestion of @yubiuser worked. Network traffic rose to a booming 9 million (I kid you not), but now seems to be dropping after some days. After updating to 15.3 the numbers are dropping even more at a faster pace.

I like the suggestion of @jfb too, that could make the stats a bit more realistic. Would changing the Pi-hole to be the DHCP server and limiting specifically the Apple TV be also something?

If you use Pi-hole as a DHCP server, you can use a dnsmasq configuration to provide a different DNS to a client by MAC ID.

I still don't understand the point (of Apple). Queries are made on the network every minute. All of which receive no meaningful answers (servfail). And that is normal (on the part of Apple). Pihole of course works as it should. I would only have hoped that one can put a stop to the behavior. A correct answer would be nice (IP, not servfail). 15.3 has still endless queries.

BTW: I use unbound. Would it help if I use a DNS server such as Google and do without unbound?
My answer: no, nxdomain is returned.

I still don't get the idea behind ...openthread.home.arpa....

Create a local DNS record in Pi-hole with the correct IP. I'm doing that and, while there are still many open thread queries, it isn't spamming the server with enough requests to set off alarms.

I have 6 HomePod Minis in my network (DHCP, dynamic). I guess I would have to switch to static IPs, right?

If you are using dnsmasq as the DHCP server, it may not be necessary as it tends to keep address constant (unless the MAC address changes). DHCP reservations work well too.

Edit:

Also, you can add a local CNAME in Pi-hole that points to the local host name of the devices.

I added a local CNAME...the answer is "NXDOMAIN". I still don't get the point. No pi-hole problem at all. I don't understand what these senseless queries are good for....

I don’t understand the point of it either. You shouldn’t gat an NXDOMAIN reply if you’ve done things right though. The target of the CNAME has to be a host name that Pi-Hole knows the answer to.

My pihole is not the DHCP server. Is this a problem? Still NXDOMAIN...

The specification calls for using the domain something.thread.home.arpa for a Thread network:

CNAME is now working...I did it manually for every HomePod Mini in my network. Far less queries in my network now.

If I understand it correctly, mDNS requests are sent to the Pihole via DNS. This can not do anything with it, because it does not understand mDNS. Is that correct?

Because that would mean that every PiHole user with HomePod Mini is flooded with DNS requests (which should be mDNS).

I am surprised that there seems to be no workaround here. Either you enter the CNAME manually, or you get flooded.

In other words: what would I have to change in my network so that mDNS is understood correctly? Is there anything that can be set on the PiHole?

Hello @anon13929094, not an answer to your questions, but some weeks after removing the rate limit my traffic is almost back to normal, meaning openthread.thread.home.arpa requests have dropped from several millions to max 2000 per day. I haven't touched the CNAME solutions mentioned above and haven't changed to using the pihole as a DHCP server yet. Just wanted to see what happened without the rate limit. I don't understand why the drop, but I am happy :slight_smile:

There is news: I use a Unifi network (Dream Machine as router/DHCP and PiHole as DNS). On the Unifi router, "mDNS" can be enabled. Since I enabled that, the requests are answered correctly. There are still a lot of requests, but when they are answered correctly, it seems like there are less requests. That would coincide with your posting @robbertnoordhoek.

Therefore, one solution may be to make sure that mDNS works properly on the network.

I will continue to monitor it.

Update: Same behavior as before. There are again very often searches for .arpa domains, which are all answered with "BOGUS" or "NXDOMAIN".

Any news from anybody? Still have thousands requests...may iOS 15.4 will fix that...