Unbound and local area DNS

Expected Behaviour:

Machine running pi-hole and unbound. I expect hosts on the local area network to resolve using their hostnames.

  • Debian Trixie
  • x86_64
  • Native installation

Actual Behaviour:

With the exception of the pi-hole itself, local hosts do not resolve.

Debug Token:

https://tricorder.pi-hole.net/AvsfPSUJ/

No help? My prior (Bookworm) installation also had this problem. Seems like something there should be a solution to. In both cases, I just followed the documentation instructions.

Hosts on your network won't 'automatically resolve' if Pi-hole is NOT your DCHP server or if it has no DNS records predefined. For Pi-hole to do the job it needs to know the mappings, either via your DHCP lease configuration or manually added DNS records.

Some computers use mDNS to resolve local hostnames. On Linux systems this might be Avahi, Apple has mDNSResponder, etc. Those are not part of Pi-hole, however, they just offer local resolution instead of Pi-hole.

What does below output on a Windows, MacOS or Linux box?

nslookup <KNOWN_DHCP_CLIENT_IP> <DHCP_DNS_SERVER_IP>

For you <DHCP_DNS_SERVER_IP> is most likely your router IPv4 address.

Eg:

$ nslookup 10.0.0.234 10.0.0.2
234.0.0.10.in-addr.arpa name = hak01.home.dehakkelaar.nl.

Have you setup shop according to below?

Some "Router setup" examples below:

This is what I get.

$ nslookup 192.168.1.88 192.168.1.1                                                        ✘ 127
88.1.168.192.in-addr.arpa	name = brother.lan.

So this problem is independent of unbound? I felt like local hosts were resolving before I installed and configured unbound.

I looked at the How To page you linked and my use case is explained (Openwrt) but I'm concerned about handing over DNS to the pi-hole because if it happens to go down, we'd lose all connectivity and I'm not always home to get everything working again. I guess I should hand out static leases to the hosts I'd like access to so that I can reach them without looking up their IP address..

Hold on!
If you're router is doing DHCP services, you can let Pi-hole discover hostnames for known client IP's via conditional forwarding (revServers):

But make sure you dont close a DNS loop where the router returns queries back to Pi-hole!

It's pretty close now. The pi-hole web interface now shows LAN client hostnames but they still aren't resolving. Seems like it should be a small step for the pi-hole to resolve these hosts through unbound.

Is that with "conditional forwarding" enabled?

If so, tail the logs live with below:

sudo pihole tail

And run an nslookup on one of your clients (Windows, MacOS or Linux) while addressing one of those hostnames.

Eg:

C:\>nslookup hak01
Server:  ph6b.home.dehakkelaar.nl
Address:  10.0.0.4

Name:    hak01.home.dehakkelaar.nl
Address:  10.0.0.234
$ sudo pihole tail
[..]
Jul  4 18:15:48: query[PTR] 4.0.0.10.in-addr.arpa from 10.0.0.179
Jul  4 18:15:48: config 4.0.0.10.in-addr.arpa is <PTR>
Jul  4 18:15:48: query[A] hak01.home.dehakkelaar.nl from 10.0.0.179
Jul  4 18:15:48: forwarded hak01.home.dehakkelaar.nl to 10.0.0.2
Jul  4 18:15:48: reply hak01.home.dehakkelaar.nl is 10.0.0.234
Jul  4 18:15:48: query[AAAA] hak01.home.dehakkelaar.nl from 10.0.0.179
Jul  4 18:15:48: forwarded hak01.home.dehakkelaar.nl to 10.0.0.2
Jul  4 18:15:48: reply hak01.home.dehakkelaar.nl is NODATA-IPv6

Above you see nslookup does three types of queries from a Windows machine.
One reverse lookup (PTR query), one A record lookup (IPv4) and one AAAA record lookup (IPv6).

EDIT:

Oh Unbound isnt involved!
If setup correctly, Unbound only receives queries for public domains and not your private ones.

Client --> Pi-hole --[public domains]--> Unbound --> Authoritative DNS servers
              |
               ------[private domains via CF]------> Router

I followed the instructions at Configuration - Pi-hole documentation so I assume conditional forwarding is enabled.

  revServers = [
    "true,192.168.1.0/24,192.168.1.1,openwrt"
  ] ### CHANGED, default = []

And here is the output from the commands you suggested:

$ nslookup kandinsky
Server:		192.168.1.2
Address:	192.168.1.2#53

** server can't find kandinsky: NXDOMAIN

and

$ sudo pihole tail
Jul  5 18:14:05: query[A] kandinsky.lan from 192.168.1.190
Jul  5 18:14:05: config kandinsky.lan is NXDOMAIN
Jul  5 18:14:05: query[A] kandinsky from 192.168.1.190
Jul  5 18:14:05: config kandinsky is NXDOMAIN

only shows A queries. Am I missing a step somewhere?

Please generate a new debug log.

Note:

Your revServers option is configured to use openwrt domain, but your network is using lan as domain.

Is your router using lan or openwrt?

Did you try using lan ("true,192.168.1.0/24,192.168.1.1,lan")?

No thats just different behavior for nslookup between Linux and Windows.
The Windows version runs a couple of extra queries.
As noted above ^, the DNS search/suffix domain names must match.

This one:

$ sudo pihole-FTL dhcp-discover
Scanning all your interfaces for DHCP servers and IPv6 routers
Timeout: 6 seconds

* Received 318 bytes from 10.0.0.2 @ eth0
[..]
  DHCP options:
   domain-name: "home.dehakkelaar.nl"

EDIT: The client receives this suffix from the router via DHCP.
And the client DNS implementation appends this suffix to the query if you only query a short hostname.

Most likely below one does return an address?

nslookup kandinsky.lan. 192.168.1.1

EDIT2: Oh if curious which DHCP clients advertised their name/hostname during the DHCP handshake:

echo 192.168.1.{1..254} | xargs -n1 dig +noall +answer @192.168.1.1 -x

Similar to what Pi-hole does to discover names behind known client addresses by conditional forwarding.

Ah, I see! I was not clear on exactly what I was supposed to put for “domain”. In retrospect, it’s obvious. Thank you!