Slow resolution when connecting over udp

PiHole is working and blocking ads. I was migrating servers and noticed the following message in syslog

Pihole service is running on a docker container and the host is running Debian Bookworm. Following message was in journalctl and repeats periodically.

Dec 17 09:25:06 titan dockerd[850]: time="2024-12-17T09:25:06.550453472-06:00" level=error msg="[resolver] failed to query external DNS server" client-addr="udp:172.19.0.12:38538" dns-server="udp:192.168.1.86:53" error="read udp 172.19.0.12:38538->192.168.1.86:53: i/o timeout" question="

I used nc to see if I could identify any differences. Not sure if this is the best way.

From within a container i noticed UDP port was slow.

# from within docker containers udp is slow.
time nc -zv 192.168.1.86 53
Connection to 192.168.1.86 53 port [tcp/*] succeeded!

real	0m0.003s
user	0m0.000s
sys	0m0.003s



time nc -zvu 192.168.1.86 53
Connection to 192.168.1.86 53 port [udp/*] succeeded!

real	0m3.004s
user	0m0.004s
sys	0m0.000s

Same command when run from the docker host itself work fine. So i tried running pihole with host networking and I saw the same behavior. I am going to try macvlan and see if it changes anything. However if host mode is not showing any changes then I am not sure maclvan will be any better.

Also another interesting thing I noticed is that when running these commands from a host other than docker host I saw the same thing. Earlier I was assuming this had something to do with docker networking. Not it seems like its not docker that's causing this issue.

I tried nslookup commands and they are returning fast. I think nslookup defaults to udp. Both these points now lead me to think its not docker thats the issue.

Any pointers on what the cause of the timeout in the system log? Or should I just ignore it :).

Ok some more info. What I have determined is that from within other docker containers I am not able to use the host_ip to resolve DNS using pihole when both pihole and the container are running on the same host.

Same command works fine if I am doing nslookup on the docker host. I was able to confirm this by running the following commands from within the container. 2 Pihole's.

Container was configured to use the following 2 pihole instances running as containers as well.

# host ip
192.168.1.86
# a different machine
192.168.1.63

nslookup


# this would take a long time to return but eventually answer.
nslookup google.com

# would time out
nslookup google.com 192.168.1.86

# this would work and returned immediately
nslookup google.com 192.168.1.63

# this would work and returned immediately. pihole is the name of my container.
nslookup google.com pihole

Now I have a user defined bridge network so that I can use docker networking to talk between containers. I am not 100% on this but I have seen some snippets that custom bridge network and dns work differently vs the default bridge network. Previously I used to run macvlan network and never ran into this issue.

What my solution was to set my pihole to static ip

networks:
      default:
        ipv4_address: <ip> # I set this to the same IP as what the container was running with

and then used the IP address used above instead of 192.168.1.86 no longer ran into any issues.

So this looks like docker networking specific issue and not pihole.