Hi, my debug token: 0w3efz0oxp every morning when logwatch is started by a cronjob, sending of the Mail doesn't work. In pi-hole.log I've found the following lines: May 19 06:25:24 dnsmasq[1127]: 10075 127.0.0.1/43498 query[A] smtp.strato.de from 127.0.0.1 May 19 06:25:24 dnsmasq[1127]: 10075 12…

After removing DNScrypt and using pi-hole+FTLDNS+Unbound+DNSSEC validation of all DNS lookups (incl. smtp.strato.de) is working very well and very fast. :smiley:

dnsmasq (FTLDNS is based on dnsmasq 2.79) considers the domain smtp.strato.de as BOGUS, meaning invalid. There are some issues with dnsmasq, regarding DNSSEC. You can read more about it here . For now, the best solution seems to be to either simply disable DNSSEC (on the pihole settings page) OR to …

That's because that domain is broken. DNSSEC Debugger - smtp.strato.de This is why DNSSEC can be bad, one mistake and the chain breaks, they are missing a couple of necessary records.

I've already installed unbound and have unchecked DNSSEC in the pi-hole UI. But this wrong validation of smtp.strato.de happens every morning at the same time. I'm not really sure if this is a problem of the implementation of the strato servers.

But here it says "Result is insecure" (and not BOGUS) and here too. So, what happens every morning at 6:25 to get a BOGUS result? I don't have all the tools to make a root cause. Perhaps we will find a workaround (or simply disable DNSSEC?).

It's sometimes hard to figure out what's wrong. First of all, it depends on the number of "server=" settings You have in /etc/dnsmasq.d (check all the files). dnsmasq has a build in feature to determine witch is the fastest configured resolver (every 20 seconds OR 50 queries), you'll see (in /var/…

You can also use the DIG test to check any resolver, that is, if your firewall allows it, for instance, for google: dig @8.8.8.8 -p 53 +dnssec www.raspberrypi.org You might consider repeating this test with the resolver, before you reconfigured your system (the resolver you were using when you st…

@jpgpi250 thanks for your hints using dig. But I still can't find the root cause. All dig-commands are giving the same and correct result. One thing I've found was a wrong entry in my ssmtp.conf which explains other errors like "Domain does not exist". But the validation of smtp.strato.de was succe…

Given the fact you're trying to send email from your raspberry (or whatever your distro is), you obviously have configured your system to do so. I've been doing exactly the same for quite some time now, using gmail. You can see how I set it up here (section 4/9 - Install mail). You might need to whi…

Thank you again. Yes I'm sending email from my raspberry (PI3 B+, stretch). I have changed the ssmtp conf-files using the IP address. So, I will give this a try. Some words to my actual configuration: pi-hole forwards to ==> 127.0.0.1#5354 (Unbound) forwards to ==> 127.0.0.1#41 (DNScrypt-proxy v2)…

Pi-hole Userspace

Strange behaviour when sending emails

Help

ftldns-beta

DanSchaper May 19, 2018, 5:36pm 5

How do I interperet the DNSSEC column in the query log? FAQs

As of Pi-hole 3.3, you can see the DNSSEC status in the query log. [40] SECURE are records that have been signed and verified to be unchanged from the authoritative DNS server INSECURE are records that either have no signature or DNSSEC is not implemented for the domain; either the domain is unsigned and not implementing DNSSEC or there are other issues BOGUS are records that have been signed but have changed or been altered from the authoritative DNS server You will see INSECURE, but that d…

show post in topic

Home
Categories
Guidelines
Terms of Service
Privacy Policy

Powered by Discourse, best viewed with JavaScript enabled