SERVFAIL in a specific domain

[nicolas-bs]

Hi everybody,

Please could someone give me a hand with this specific domain, I could open any website but not this.

[jfb]

It appears your local unbound instance is experiencing problems. SERVFAIL is frequently related to incorrect time or DNSSEC errors.

[nicolas-bs]

How could I check and fix it ?

[deHakkelaar]

First lets check date/time.
Whats output for below two?

timedatectl

timedatectl timesync-status

If date/time is incorrect and want to change, you have to disable NTP time syncing first with below:

sudo timedatectl set-ntp 0

Set the time manually (change date/time below to actual):

sudo timedatectl set-time '2021-06-24 03:50:00'

Enable time sync again:

sudo timedatectl set-ntp 1

And verify:

timedatectl

A very long thread below with hints how to diagnose unbound:

Need help and techniques to debug DNS failure on Facebook and Instagram using Pihole with Unbound

For diagnosing, configure something else in Pi-hole for upstream DNS resolution (not unbound). You can do below to output verbose debug logging for unbound to screen (dont need to change port etc): sudo service unbound stop sudo /usr/sbin/unbound -ddd -vvv -c /etc/unbound/unbound.conf Inspect for errors/warnings when started and see whats logged when you do below dig in another SSH session: dig @localhost -p 5335 a www.instagram.com. EDIT: Might want to compare with a dig for another domai…

[Bucking_Horn]

That domain resolves fine for my unbound installation.

SERVFAIL is just a generic error message indicating a server side resolution failure, making it somewhat hard to troubleshoot.

Before you dive into detailed unbound analysis as suggested in the topic linked by deHakkelaar, verify if you can access that domain now.

Ocassionally, SERVFAIL is seen only temporarily, e.g. because of intermittent high loads on a DNS server, or caused by a misconfiguration of an authoritative DNS server, which respective maintainers would have an interest in to address rather quickly.

If it's still not resolving today, a dig via Cloudflare's resolvers may return an Extended DNS Error (EDE) with an error code that is more detailed than the generic SERVFAIL (see MS Teams gets no presence status for contacts - #6 by Bucking_Horn for more details).

If none of the above is applicable, then analysing unbound in detail may at least allow you get a better understanding why that domain doesn't resolve.

[nicolas-bs]

I'm not an expert on this.

I doublecheck the timedate and seems to be correct.

   Server: 162.159.200.123 (0.debian.pool.ntp.org)
Poll interval: 34min 8s (min: 32s; max 34min 8s)
     Leap: normal
  Version: 4
  Stratum: 3
Reference: A0F0A86
Precision: 1us (-25)
Root distance: 8.749ms (max: 5s)
   Offset: +2.510ms
    Delay: 90.413ms
   Jitter: 3.371ms
Packet count: 30
Frequency: -7.059ppm

But believe is the unique web page that does not load (servers could not be reached), so weird.

Thanks for your support guys!