# Retrieval of supported OS list failed. dig failed with return code 10. Unable to determine if the detected OS (Debian 12) is supported

**URL:** <https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568>\
**Category:** Help\
**Created:** [March 6, 2025, 7:08pm UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568 "2025-03-06T19:08:27Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![BenR](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/benr/32/46480_2.png) [@BenR](https://discourse.pi-hole.net/u/BenR)\
**Post date:** [March 6, 2025, 7:08pm UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/1 "2025-03-06T19:08:27Z")

</div>

Hi,  
I've been using pihole for a couple of years now with unbound and cloudflare without any issues. Recently after updating to pihole 6.XX I experienced the error " Retrieval of supported OS list failed. dig failed with return code 10.  
Unable to determine if the detected OS (Debian 12) is supported"  
PiHole is running on my raspberrypi 4B 4GB  
I run a docker with Nginx Proxy Manager and pialert.

I also had installed NordVPN but disabled it as I thought this was the issue but this wasn't the case.

## Debug Token:

[https://tricorder.pi-hole.net/8G5BpH8s/](https://tricorder.pi-hole.net/8G5BpH8s/)

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [March 7, 2025, 12:07am UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/2 "2025-03-07T00:07:38Z")

</div>

Let's take a look at the corresponding lines in your debug log:

```auto
*** [DIAGNOSING]: Operating system
[i] Distro: Debian
[i] Version: 12
[✗] dig IPv4 return code: 9
[✗] dig response: ;; communications error to 205.251.193.151#53: timed out
[i] Retrying via IPv6
[✗] dig IPv6 return code: 9
[✗] dig response: ;; communications error to 2600:9000:5301:9700::1#53: timed out
[✗] Error: dig command failed - Unable to check OS

```

The OS check failed as communication with the public DNS server for pi-hole.net timed out.

I addition, Pi-hole's debug script also failed to retrieve DNS replies from public DNS servers:

```auto
*** [DIAGNOSING]: Name resolution (IPv4) using a random blocked domain and a known ad-serving domain
[✓] adf.shinobi.jp is NOERROR on lo (127.0.0.1)
[✓] adf.shinobi.jp is NOERROR on eth0 (192.168.1.137)
[✓] adf.shinobi.jp is NOERROR on br-775f80ffb4cf (172.18.0.1)
[✓] adf.shinobi.jp is NOERROR on docker0 (172.17.0.1)
[✗] Failed to resolve doubleclick.com via a remote, public DNS server (8.8.8.8)

*** [DIAGNOSING]: Name resolution (IPv6) using a random blocked domain and a known ad-serving domain
[✓] www.allegrolokalnie.pl-oferta7224283.cfd is NOERROR on lo (::1)
[✓] www.allegrolokalnie.pl-oferta7224283.cfd is NOERROR on eth0 (2001:<redacted>e)
[✓] www.allegrolokalnie.pl-oferta7224283.cfd is NOERROR on eth0 (fe80::d<redacted>4%eth0)
[✓] www.allegrolokalnie.pl-oferta7224283.cfd is NOERROR on br-775f80ffb4cf (fe80::c<redacted>f%br-775f80ffb4cf)
[✓] www.allegrolokalnie.pl-oferta7224283.cfd is NOERROR on docker0 (fe80::f<redacted>7%docker0)
[✗] Failed to resolve doubleclick.com via a remote, public DNS server (2001:4860:4860::8888)

```

This may suggest that something is blocking DNS requests to public DNS servers for the machine that runs your Pi-hole.  
Would your router perhaps only allow specific DNS servers and/or protocols?

Furthermore, there are a few SERVFAIL replies from your upstreams:

```auto
   Mar 6 00:00:08 dnsmasq[810]: query[AAAA] pool.ntp.org from 192.168.1.137
   Mar 6 00:00:08 dnsmasq[810]: forwarded pool.ntp.org to 127.0.0.1#5335
   Mar 6 00:00:08 dnsmasq[810]: forwarded pool.ntp.org to 127.0.0.1#5053
   Mar 6 00:00:08 dnsmasq[810]: forwarded pool.ntp.org to 1.1.1.1
   Mar 6 00:00:08 dnsmasq[810]: reply error is SERVFAIL

```

As unbound as well as dnscrypt require an accurate time, those SERVFAILs for pool.ntp.org (as required for a time-sync) may indicate that your time is off.

You should verify your Pi-hole machine's time and time zone settings.

And as you are using cloudflared, you should also check [Issues with using cloudflared as upstream DNS server](https://discourse.pi-hole.net/t/v6-post-release-fixes-and-findings/76480#:~:text=Issues%20with%20using%20cloudflared%20as%20upstream%20DNS%20server).

---

<div class="post-metadata">

**Author:** ![BenR](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/benr/32/46480_2.png) [@BenR](https://discourse.pi-hole.net/u/BenR)\
**Post date:** [March 7, 2025, 6:22am UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/3 "2025-03-07T06:22:31Z")

</div>

Thank you for take a look at my debug logs.

I'll check my piholes time mac, time zone and cloudflare and let you know the outcome.

---

<div class="post-metadata">

**Author:** ![KK1L](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/k/d26b3c/32.png) [@KK1L](https://discourse.pi-hole.net/u/KK1L)\
**Post date:** [March 7, 2025, 9:13pm UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/4 "2025-03-07T21:13:54Z")

</div>

Watching! Have exactly this issue. Does this happen to be a backup pihole and were you running gravity-sync? In my case I upgraded my primary first and it took some time before I upgraded the backup. I cannot get upbound to function on the backup. The primary works fine-ish.

---

<div class="post-metadata">

**Author:** ![BenR](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/benr/32/46480_2.png) [@BenR](https://discourse.pi-hole.net/u/BenR)\
**Post date:** [March 7, 2025, 9:42pm UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/5 "2025-03-07T21:42:33Z")

</div>

Currently, I'm still troubleshooting. It started straight after upgrading to v6.  
When I disable pihole I still encounter some weird dns issues with UDP. It might be my ISP, but I'm not sure yet. I'll update once I find something or need help. I even reinstalled Pihole fresh but still have the same issue.

---

<div class="post-metadata">

**Author:** ![CallMeCurious](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/c/c4cdca/32.png) [@CallMeCurious](https://discourse.pi-hole.net/u/CallMeCurious)\
**Post date:** [March 7, 2025, 9:56pm UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/6 "2025-03-07T21:56:13Z")

</div>

> [@KK1L](#):
>
> gravity-sync

Gravity Sync is retired as of July 24. Given Pihole V6 Changes its not going to be usable. I've seen some people talk about orbital-sync as a replacement.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [March 7, 2025, 9:58pm UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/7 "2025-03-07T21:58:13Z")

</div>

> [@KK1L](#):
>
> I cannot get upbound to function on the backup

Please open a new help topic.

---

<div class="post-metadata">

**Author:** ![KK1L](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/k/d26b3c/32.png) [@KK1L](https://discourse.pi-hole.net/u/KK1L)\
**Post date:** [March 7, 2025, 10:02pm UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/8 "2025-03-07T22:02:52Z")

</div>

Yes I am aware...thanks. I mention the timing of my upgrade because it was still running on the backup pi-hole for a bit after upgrading the primary, so could have borked something. It is uninstalled. I don't want to continue this conversation here.

---

<div class="post-metadata">

**Author:** ![KK1L](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/k/d26b3c/32.png) [@KK1L](https://discourse.pi-hole.net/u/KK1L)\
**Post date:** [March 7, 2025, 10:05pm UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/9 "2025-03-07T22:05:13Z")

</div>

Not intending to hijack. Might be related to this tread's issue. Will sit back and watch this.

---

<div class="post-metadata">

**Author:** ![BenR](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/benr/32/46480_2.png) [@BenR](https://discourse.pi-hole.net/u/BenR)\
**Post date:** [March 10, 2025, 9:55am UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/10 "2025-03-10T09:55:59Z")

</div>

Here is my update:

When I use pure dnsmasq as standalone, most of my DNS requests will be resolved, but every now and then, the request gets a timeout / servfail with UDP.

Using dig with PiHole enabled I see most public DNS upstream work like Google (8.8.8.8 / 8.8.4.4) and Cloudflare (1.1.1.1 / 1.0.0.1)

NSlookup works most of the time using public DNS upstream but fails using PiHole with and without Unbound and Cloudflare (DoH).

On my ISP router I port fowarded 53 UDP/TCP but this didn't seems to work.  
My PiHole is connected by a PoE switch striaght to my ISP router.

As already mentioned I have reinstalled PiHole but still experience the same issue with the OS check.

If anybody has any suggestions how to solve this It would be appreciated.

---

<div class="post-metadata">

**Author:** ![BenR](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/benr/32/46480_2.png) [@BenR](https://discourse.pi-hole.net/u/BenR)\
**Post date:** [March 10, 2025, 10:16am UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/11 "2025-03-10T10:16:33Z")

</div>

Ow btw as far as I checked the PiHoles machine time, time zone is running as it should and removed `lighttpd` just to be sure.

> Mon Mar 10 11:15:19 CET 2025  
> Local time: Mon 2025-03-10 11:15:19 CET  
> Universal time: Mon 2025-03-10 10:15:19 UTC  
> RTC time: n/a  
> Time zone: Europe/Amsterdam (CET, +0100)  
> System clock synchronized: yes  
> NTP service: active  
> RTC in local TZ: no

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [March 10, 2025, 10:52am UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/12 "2025-03-10T10:52:53Z")

</div>

Please provide a fresh debug token.

---

<div class="post-metadata">

**Author:** ![BenR](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/benr/32/46480_2.png) [@BenR](https://discourse.pi-hole.net/u/BenR)\
**Post date:** [March 10, 2025, 10:55am UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/13 "2025-03-10T10:55:57Z")

</div>

[✓] Your debug token is: [https://tricorder.pi-hole.net/HogARutV/](https://tricorder.pi-hole.net/HogARutV/)

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [March 10, 2025, 6:03pm UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/14 "2025-03-10T18:03:27Z")

</div>

Your debug log shows that your Pi-hole is receiving traffic from public IP addresses.

This may have happened due to:

> [@BenR](#):
>
> On my ISP router I port fowarded 53 UDP/TCP but this didn't seems to work.

You are risking to run Pi-hole as an open resolver, posing a potential threat for all Internet users, e.g. by serving as a multiplier in a [DNS Amplification attack](https://www.cloudflare.com/learning/ddos/dns-amplification-ddos-attack/).

**The Pi-hole team strongly discourages Pi-hole’s usage as an open resolver, and we won't provide support in that case.**

Please close inbound port 53 on your router's firewall immediately.

EDIT: When done, please provide a fresh debug token.

---

<div class="post-metadata">

**Author:** ![BenR](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/benr/32/46480_2.png) [@BenR](https://discourse.pi-hole.net/u/BenR)\
**Post date:** [March 10, 2025, 6:36pm UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/15 "2025-03-10T18:36:23Z")

</div>

yeah I release it when I checked the debug myself so I already closed it this was more to check if it was my isp router but it wasn't

---

<div class="post-metadata">

**Author:** ![BenR](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/benr/32/46480_2.png) [@BenR](https://discourse.pi-hole.net/u/BenR)\
**Post date:** [March 12, 2025, 11:06am UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/16 "2025-03-12T11:06:00Z")

</div>

sorry for delay was swamp at work.  
Here's the new token:  
[✓] Your debug token is: [https://tricorder.pi-hole.net/EAIOpjp5/](https://tricorder.pi-hole.net/EAIOpjp5/)

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [March 12, 2025, 2:58pm UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/17 "2025-03-12T14:58:24Z")

</div>

```auto
*** [DIAGNOSING]: Operating system
[i] Distro: Debian
[i] Version: 12
[✗] dig IPv4 return code: 9
[✗] dig response: ;; communications error to 205.251.193.151#53: timed out
[i] Retrying via IPv6
[✗] dig IPv6 return code: 9
[✗] dig response: ;; communications error to 2600:9000:5301:9700::1#53: timed out
[✗] Error: dig command failed - Unable to check OS

```

What is the output of the following command from the Pi terminal:

`dig +short -t txt versions.pi-hole.net @ns1.pi-hole.net`

---

<div class="post-metadata">

**Author:** ![BenR](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/benr/32/46480_2.png) [@BenR](https://discourse.pi-hole.net/u/BenR)\
**Post date:** [March 12, 2025, 7:07pm UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/18 "2025-03-12T19:07:45Z")

</div>

**Update**  
So I found out that my ISP is blocking UDP #53  
When I use Unbound (127.0.0.1:5335) as its upstream resolver, forwarding to Cloudflare (1.1.1.1/1.0.0.1) with forward-tcp-upstream: yes, I was able to bypass my ISP’s UDP/53 block.

Client queries (e.g., nslookup google.com 192.168.1.137) and manual dig tests through Unbound (e.g., dig @127.0.0.1 -p 5335) resolve correctly now.

**Issue I discovered**

- When using dig +short -t txt versions.pi-hole.net @ns1.pi-hole.net, results in:

> ;; communications error to 2600:9000:5301:9700::1#53: timed out  
> ;; communications error to 2600:9000:5301:9700::1#53: timed out  
> ;; communications error to 2600:9000:5301:9700::1#53: timed out  
> ;; communications error to 205.251.193.151#53: timed out  
> ;; no servers could be reached

\*When using dig +short -t txt versions.pi-hole.net @127.0.0.1 -p 5335 +tcp or dig +short -t txt versions.pi-hole.net @127.0.0.1 -p 5335 results in:

> "Raspbian=11,12 Ubuntu=20,22,23,24 Debian=11,12 Fedora=40,41 CentOS=9"

New token: [https://tricorder.pi-hole.net/ITxL7abU/](https://tricorder.pi-hole.net/ITxL7abU/)

---

<div class="post-metadata">

**Author:** ![BenR](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/benr/32/46480_2.png) [@BenR](https://discourse.pi-hole.net/u/BenR)\
**Post date:** [March 17, 2025, 5:18pm UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/19 "2025-03-17T17:18:26Z")

</div>

Hi all,

I contacted my ISP they had some issues with disabling me from their CGNAT which got solved today hoping this solved the issue with my UDP #53 but that was not the case.

One more question I'm missing setupVars.conf in /etc/pihole/ after reinstallation of v6 could this be an issue?

Any help to solve this issue would be appreciated.

New Token:  
[https://tricorder.pi-hole.net/KyIuUiYC/](https://tricorder.pi-hole.net/KyIuUiYC/)

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [March 17, 2025, 9:33pm UTC](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568/20 "2025-03-17T21:33:33Z")

</div>

If your ISP blocks port 53, then Pi-hole's OS check is bound to fail (using the very command that **jfb** asked you to run).

You could try to shadow `ns1.pi-hole.net`, by placing a respective entry in `/etc/hosts` on your Pi-hole machine, pointing it to `127.0.0.1`.

This should allow the OS check to commence, as long as your Pi-hole's upstreams would be able to successfully resolve `versions.pi-hole.net`.

[Next page](https://discourse.pi-hole.net/t/retrieval-of-supported-os-list-failed-dig-failed-with-return-code-10-unable-to-determine-if-the-detected-os-debian-12-is-supported/77568.md?page=2)