Unbound + pihole not resolving some domains (time problem)

Help
1

Please follow the below template, it will help us to help you!

Expected Behaviour:

Resolve domain to hbogo.com
Resolve domain to playstation network

Actual Behaviour:

Domain will not resolve simply a 0.0.0.0

I have followed this how to on setting unbound as a recursive server but everytime I seem to get issues with unbound not resolving certain IP addresses. I get some PS4 online server errors when I play along with hbogo.com and hbonow.com simply not resolving.

I download the additional root.hints file and change the user to unbound, my thought was maybe the unbound servers were not being used or the file could not be used by unbound due to user permissions.

I am back to DNS over TLS at this time due to not wanting SO up my you know what.

2

Thats the new way of Pi-hole routing blocked domains that are on the lists:

https://docs.pi-hole.net/ftldns/blockingmode/

pi@noads:~ $ pihole -q hbogo.com
 Match found in list.0.raw.githubusercontent.com.domains:
   metrics.hbogo.com
   smetrics.hbogo.com
 Match found in list.2.sysctl.org.domains:
   metrics.hbogo.com

Whitelisting is possible here:

http://pi.hole/admin/list.php?l=white

And after whitelisting, you might need to flush DNS cache for OS and browser(s) on your clients.

3

I am not sure this is an issue of blocking?

Leaving all of my lists the same which I use all of WaLLy's checked lists with a few pieces whitelisted I resolve all of these IPs just fine. But once I go unbound DNS these fail.

I know the main playstation issue revolves around fortnite and my connection to the PSN network. I wish I had the url for this.

4

Why not try whitelist all three:

pihole -w metrics.hbogo.com smetrics.hbogo.com metrics.hbogo.com

Can always remove if not working out as expected:

pihole -w -d metrics.hbogo.com smetrics.hbogo.com metrics.hbogo.com

Lists can be checked with:

pihole -q <DOMAIN_NAME>

EDIT: and dont forget client cache!

5

Just to be clear again sorry.

When I use pi-hole with unbound using DNS over TLS and change nothing hbogo.com resolves just fine with about six replys with different IPs

When I switch pi-hole to unbound using root.hint servers it will not resolve it seems like even when configured the config is not pulling any servers from the root hints file? When I view hbogo.com it simply goes to 127.0.0.1

I realize I had this incorrect it does not go to 0.0.0.0 as I previously mentioned in my opening post.

6

Try some lookups on a client PC (Linux, Windows or Mac):

nslookup hbogo.com

nslookup hbogo.com <PIHOLE_IP_ADDRESS>

nslookup hbogo.com <UNBOUND_IP_ADRESS>

And Google's public DNS 8.8.8.8:

nslookup hbogo.com 8.8.8.8

Or specify different port to query:

nslookup -port=5353 hbogo.com <UNBOUND_IP_ADRESS>

8

nslookup is your friend :wink:

10

This seems to be the error that it is going to the wrong location any recommendation on how to set a local for pihole to understand I am in fact in the correct location? I assume I need to setup my /etc/hosts file or setup a new file within dnsmas/FTL?

12

Ok I figured it out through ubound config and setting forward-zones I have it going to 1.1.1.1 over TLS for hbonow and hbogo and this does seem to work and I will investigate which playstation server I need to add.

14

This is happening to me with a local unRAID server. I'm using ssl to connect to the webUI so I'm not sure if unbound is seeing differently because of that? Should I enable something or whitelist my unRAID webUI?

15

What I have figured out is using the root.hints servers they seem to be giving my location incorrectly so they are not resolving hbo because it thinks I am in a country that does not have this service.

Also my system does not support ipv6 at this time therefore some cdn's are failing as they are ipv6 only or are not giving me their ipv4 version.

At this time I have gone to dnscrypt v2 connecting to cloudflare DOH. I need dns to work in my house unless I want to sleep on the couch for the foreseeable future.

16

Sep 01 18:49:45 pihole systemd[1]: Starting Unbound DNS server...
Sep 01 18:49:46 pihole package-helper[2847]: /var/lib/unbound/root.key has content
Sep 01 18:49:46 pihole package-helper[2847]: fail: the anchor is NOT ok and could not be fixed
Sep 01 18:49:46 pihole systemd[1]: Started Unbound DNS server.
Sep 01 18:49:46 pihole unbound[2878]: [2878:0] notice: init module 0: validator
Sep 01 18:49:46 pihole unbound[2878]: [2878:0] notice: init module 1: iterator
Sep 01 18:49:46 pihole unbound[2878]: [2878:0] info: start of service (unbound 1.6.0).

Seem to be getting this error on my start up of unbound. I have tried with unbound-anchor to fix the root.key file. I do not know if this is a permission error everything for unbound is under root at this time.

Also tried setting everything to unbound user/group with same error

18

Tried with setting everything in folder and folder to unbound:unbound restarted and same error. Tried running a unbound-anchor -a /var/lib/unbound/root.key no error but same error when i reboot unbound.

20

I tried with Sudo and without and still get the same error
. IN DS 19036 8 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5
. IN DS 20326 8 2 E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D

Here are the two keys that go in to that file. I changed the permission to unbound on root.key again after this install

EDIT: Unbound does show as started but it will not resolve anything due to I am guessing the root.key failure shown in the systemctl log.

23

Expanding my logs I am seeing all requests are being sent to THROWAWAY my only thought is since pihole are on the same RPI that #53 is already in use?

Sep  2 20:10:16 pihole unbound: [9654:0] info: resolving cnn.com. A IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: priming . IN NS
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.33.4.12#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 193.0.14.129#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 199.7.83.42#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.203.230.10#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.5.5.241#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.33.4.12#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.36.148.17#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.5.5.241#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 199.7.91.13#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 199.7.83.42#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 198.41.0.4#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.112.36.4#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 202.12.27.33#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 199.7.83.42#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.203.230.10#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 199.7.83.42#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.112.36.4#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.5.5.241#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.36.148.17#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 199.7.91.13#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.112.36.4#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.203.230.10#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 198.97.190.53#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.33.4.12#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 198.41.0.4#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.58.128.30#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 199.7.83.42#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.112.36.4#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.36.148.17#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.5.5.241#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.36.148.17#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 202.12.27.33#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
Sep  2 20:10:16 pihole unbound: [9654:0] info: response for . NS IN
Sep  2 20:10:16 pihole unbound: [9654:0] info: reply from <.> 192.5.5.241#53
Sep  2 20:10:16 pihole unbound: [9654:0] info: query response was THROWAWAY
25

I figured out on a Windows 7 box, the "nslookup -port=" option seems not to be working :frowning:
Better install a Windows "dig" version or some other DNS tool:

26

So a change of gears is I was using DNS over TLS than using Unbound as a recursive resolver which was failing some resolves like hbogo and hbonow. I stopped that during this process and now I tried unbound as recursive but I keep getting the error:

Sep 01 18:49:46 pihole package-helper[2847]: fail: the anchor is NOT ok and could not be fixed
28

I will look in to this also.

I have tried updating the anchor after the fact and it still fails. I am running NTP on Raspbian Lite my local time is correct it shows but my server time shows UTC time. I will investigate.

In searching this type of issue on DDG I am not finding that as a bug in any of my searches.

29

I setup NTP per some DDG searching and it WORKED!

; <<>> DiG 9.10.3-P4-Raspbian <<>> pi-hole.net @127.0.0.1 -p 5355
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36671
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 6, ADDITIONAL: 13

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;pi-hole.net.			IN	A

;; ANSWER SECTION:
pi-hole.net.		86400	IN	A	206.189.252.21

;; AUTHORITY SECTION:
pi-hole.net.		86400	IN	NS	ns1.pi-hole.net.
pi-hole.net.		86400	IN	NS	ns4.pi-hole.net.
pi-hole.net.		86400	IN	NS	ns3.pi-hole.net.
pi-hole.net.		86400	IN	NS	ns6.pi-hole.net.
pi-hole.net.		86400	IN	NS	ns5.pi-hole.net.
pi-hole.net.		86400	IN	NS	ns2.pi-hole.net.

;; ADDITIONAL SECTION:
ns1.pi-hole.net.	86400	IN	A	208.94.148.4
ns2.pi-hole.net.	86400	IN	A	208.80.124.4
ns3.pi-hole.net.	86400	IN	A	208.80.126.4
ns4.pi-hole.net.	86400	IN	A	208.80.125.4
ns5.pi-hole.net.	86400	IN	A	208.80.127.4
ns6.pi-hole.net.	86400	IN	A	208.94.149.4
ns1.pi-hole.net.	86400	IN	AAAA	2600:1800:10::1
ns2.pi-hole.net.	86400	IN	AAAA	2600:1801:11::1
ns3.pi-hole.net.	86400	IN	AAAA	2600:1802:12::1
ns4.pi-hole.net.	86400	IN	AAAA	2600:1801:13::1
ns5.pi-hole.net.	86400	IN	AAAA	2600:1802:14::1
ns6.pi-hole.net.	86400	IN	AAAA	2600:1800:15::1

;; Query time: 274 msec
;; SERVER: 127.0.0.1#5355(127.0.0.1)
;; WHEN: Tue Sep 04 08:42:29 CDT 2018
;; MSG SIZE  rcvd: 428

Verified DNSSEC sigok and sigfail both work now also!

1 Like
32

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.