I have installed Unbound and notice rapid decline in DNS requests - from nearly 100k/day and 45% blocked to 25k/4 days (for now) and 11% blocked.
Is this normal? This is because Unbound working properly?
Client requests are controlled by the clients, not by unbound.
Unbound is just another upstream DNS server (similar to Cloudflare, Google, Quad9, etc) but it's running on your network and not run by somebody else.
Blocking is done by Pi-hole (not unbound), and is solely dependent on your blocklists and domain blocks and client requests.
Network query volume and block rate naturally change over time, as different clients have different activities and at different times.
thanks for clearing that out.
It's strange, because two clients of my network - business laptop and tablet - usually generating 10x more DNS requests, and today is as on the pictures.. I don't understand, because I've change only two things - installed Unbound and i has switched out nightly restarts.
Debug log shows only one unusual thing - warning about system, because "Raspbian is supported but version 10 is currently unsupported"
Everything is working fine, but I like knowing what's going on
This is correct. Raspbian 10 is not supported by either Pi-hole or Raspbian.
dig +short -t txt versions.pi-hole.net @ns1.pi-hole.net
"Raspbian=11,12 Ubuntu=20,22,23,24 Debian=11,12 Fedora=39,40 CentOS=9"
Yes, I know this, but thanks for your response anyway - it is not supprted, but I don't think that means not working at all in "Raspbian 10".
And I was hoping to know how to identify what is the cause of that behaviour. Is pi-hole "leaking" DNS requests? Or is that something else? How to check if pi-hole works properly? To this week it was working just perfect.
Now I was trying to generate debug log with database check but this process never ends..
Look at this printscreen - it is one of two computers with the highest number of DNS req.
I think you are worried about the numbers, but apparently Pi-hole is working and blocking some queries.
Are you seeing ads in some of your clients?
I don't see much on that screen that would concern me.
Some of the queries are being blocked by Pi-hole, as expected.
Others are being forwarded to your local instance of unbound for resolution.
The concern is with the N/A replies.
For more details, take a look in the dnsmasq log at /var/log/pihole/pihole.log. That text file contains all the queries, forwards and replies.
In particular, take a look at the queries that don't receive a reply from unbound.
Actually no - I was intrigued by the situation with such a large drop in queries that shows and blocks pi-hole. You know - it is not a problem, I'm curious what causes that.I am not a techncian, rather hobbyst