WARNING Connection error (127.0.0.1#5335): failed to send TCP(read_write)

General Beta 6.0
1

I got on a regular basis these errors in FTL.log:
2024-11-11 22:30:57.865 WARNING Connection error (127.0.0.1#5335): failed to send TCP(read_write) packet (Connection prematurely closed by remote server)
2024-11-11 22:30:58.273 WARNING Connection error (127.0.0.1#5335): failed to send TCP(read_write) packet (Connection prematurely closed by remote server)
2024-11-11 22:30:59.149 WARNING Connection error (127.0.0.1#5335): failed to send TCP(read_write) packet (Connection prematurely closed by remote server)

In pihole .log I see this:
Nov 11 22:30:57 dnsmasq[236361]: query[HTTPS] science.nasa.gov from 192.168.2.79
Nov 11 22:30:57 dnsmasq[236360]: forwarded science.nasa.gov to 127.0.0.1#5335
Nov 11 22:30:57 dnsmasq[236361]: forwarded science.nasa.gov to 127.0.0.1#5335
Nov 11 22:30:57 dnsmasq[236360]: reply science.nasa.gov is
Nov 11 22:30:57 dnsmasq[236361]: reply science.nasa.gov is
Nov 11 22:30:57 dnsmasq[236361]: reply nasa-smd.go-vip.net is NODATA
Nov 11 22:30:57 dnsmasq[236360]: reply nasa-smd.go-vip.net is 192.0.66.108
Nov 11 22:30:57 dnsmasq[236362]: query[A] cdn.parsely.com from 192.168.2.79
Nov 11 22:30:57 dnsmasq[236363]: query[HTTPS] cdn.parsely.com from 192.168.2.79
Nov 11 22:30:57 dnsmasq[236362]: gravity blocked cdn.parsely.com is 0.0.0.0
Nov 11 22:30:57 dnsmasq[236363]: gravity blocked cdn.parsely.com is NODATA
Nov 11 22:30:57 dnsmasq[236364]: query[A] images-assets.nasa.gov from 192.168.2.79
Nov 11 22:30:57 dnsmasq[236365]: query[HTTPS] images-assets.nasa.gov from 192.168.2.79
Nov 11 22:30:57 dnsmasq[236366]: query[A] assets.science.nasa.gov from 192.168.2.79
Nov 11 22:30:57 dnsmasq[236367]: query[HTTPS] assets.science.nasa.gov from 192.168.2.79
Nov 11 22:30:57 dnsmasq[236368]: query[A] plus.nasa.gov from 192.168.2.79
Nov 11 22:30:57 dnsmasq[236369]: query[HTTPS] plus.nasa.gov from 192.168.2.79
Nov 11 22:30:57 dnsmasq[236366]: failed to send TCP(read_write) packet: Connection prematurely closed by remote server
Nov 11 22:30:57 dnsmasq[236370]: query[A] assets.science.nasa.gov from 192.168.2.79
Nov 11 22:30:57 dnsmasq[236368]: forwarded plus.nasa.gov to 127.0.0.1#5335
Nov 11 22:30:57 dnsmasq[236368]: reply plus.nasa.gov is
Nov 11 22:30:57 dnsmasq[236369]: forwarded plus.nasa.gov to 127.0.0.1#5335
Nov 11 22:30:57 dnsmasq[236368]: reply nasa-tv.go-vip.net is 192.0.66.108
Nov 11 22:30:57 dnsmasq[236369]: reply plus.nasa.gov is
Nov 11 22:30:57 dnsmasq[236369]: reply nasa-tv.go-vip.net is NODATA
Nov 11 22:30:58 dnsmasq[236367]: forwarded assets.science.nasa.gov to 127.0.0.1#5335
Nov 11 22:30:58 dnsmasq[236370]: forwarded assets.science.nasa.gov to 127.0.0.1#5335
Nov 11 22:30:58 dnsmasq[236367]: reply assets.science.nasa.gov is
Nov 11 22:30:58 dnsmasq[236370]: reply assets.science.nasa.gov is
Nov 11 22:30:58 dnsmasq[236367]: reply dc10yw3ziyn5p.cloudfront.net is NODATA
Nov 11 22:30:58 dnsmasq[236370]: reply dc10yw3ziyn5p.cloudfront.net is 18.239.50.27
Nov 11 22:30:58 dnsmasq[236370]: reply dc10yw3ziyn5p.cloudfront.net is 18.239.50.67
Nov 11 22:30:58 dnsmasq[236370]: reply dc10yw3ziyn5p.cloudfront.net is 18.239.50.66
Nov 11 22:30:58 dnsmasq[236370]: reply dc10yw3ziyn5p.cloudfront.net is 18.239.50.4
Nov 11 22:30:58 dnsmasq[236372]: query[HTTPS] images-assets.nasa.gov from 192.168.2.79
Nov 11 22:30:58 dnsmasq[236371]: query[A] images-assets.nasa.gov from 192.168.2.79
Nov 11 22:30:58 dnsmasq[236372]: failed to send TCP(read_write) packet: Connection prematurely closed by remote server
Nov 11 22:30:58 dnsmasq[236371]: forwarded images-assets.nasa.gov to 127.0.0.1#5335
Nov 11 22:30:58 dnsmasq[236364]: forwarded images-assets.nasa.gov to 127.0.0.1#5335
Nov 11 22:30:58 dnsmasq[236365]: forwarded images-assets.nasa.gov to 127.0.0.1#5335
Nov 11 22:30:58 dnsmasq[236371]: reply images-assets.nasa.gov is
Nov 11 22:30:58 dnsmasq[236365]: reply images-assets.nasa.gov is
Nov 11 22:30:58 dnsmasq[236364]: reply images-assets.nasa.gov is
Nov 11 22:30:58 dnsmasq[236371]: reply images-assets.nasawestprime.com is
Nov 11 22:30:58 dnsmasq[236365]: reply images-assets.nasawestprime.com is
Nov 11 22:30:58 dnsmasq[236364]: reply images-assets.nasawestprime.com is
Nov 11 22:30:58 dnsmasq[236365]: reply d3hl9tybgpykre.cloudfront.net is NODATA
Nov 11 22:30:58 dnsmasq[236371]: reply d3hl9tybgpykre.cloudfront.net is 18.238.243.101
Nov 11 22:30:58 dnsmasq[236371]: reply d3hl9tybgpykre.cloudfront.net is 18.238.243.45
Nov 11 22:30:58 dnsmasq[236364]: reply d3hl9tybgpykre.cloudfront.net is 18.238.243.101
Nov 11 22:30:58 dnsmasq[236371]: reply d3hl9tybgpykre.cloudfront.net is 18.238.243.127
Nov 11 22:30:58 dnsmasq[236364]: reply d3hl9tybgpykre.cloudfront.net is 18.238.243.45
Nov 11 22:30:58 dnsmasq[236371]: reply d3hl9tybgpykre.cloudfront.net is 18.238.243.90
Nov 11 22:30:58 dnsmasq[236364]: reply d3hl9tybgpykre.cloudfront.net is 18.238.243.127
Nov 11 22:30:58 dnsmasq[236364]: reply d3hl9tybgpykre.cloudfront.net is 18.238.243.90
Nov 11 22:30:58 dnsmasq[236373]: query[A] eex-gateway.fr011.ttecfed.com from 192.168.2.79
Nov 11 22:30:58 dnsmasq[236374]: query[HTTPS] eex-gateway.fr011.ttecfed.com from 192.168.2.79
Nov 11 22:30:58 dnsmasq[236375]: query[A] content-autofill.googleapis.com from 192.168.2.79
Nov 11 22:30:58 dnsmasq[236375]: cached content-autofill.googleapis.com is 142.250.179.170
Nov 11 22:30:58 dnsmasq[236375]: cached content-autofill.googleapis.com is 172.217.168.234
Nov 11 22:30:58 dnsmasq[236375]: cached content-autofill.googleapis.com is 142.251.36.42
Nov 11 22:30:58 dnsmasq[236375]: cached content-autofill.googleapis.com is 142.250.179.138
Nov 11 22:30:58 dnsmasq[236375]: cached content-autofill.googleapis.com is 216.58.208.106
Nov 11 22:30:58 dnsmasq[236375]: cached content-autofill.googleapis.com is 172.217.23.202
Nov 11 22:30:58 dnsmasq[236375]: cached content-autofill.googleapis.com is 142.251.39.106
Nov 11 22:30:58 dnsmasq[236375]: cached content-autofill.googleapis.com is 142.251.36.10
Nov 11 22:30:58 dnsmasq[236375]: cached content-autofill.googleapis.com is 142.250.179.202
Nov 11 22:30:58 dnsmasq[236376]: query[HTTPS] content-autofill.googleapis.com from 192.168.2.79
Nov 11 22:30:58 dnsmasq[236376]: cached content-autofill.googleapis.com is NODATA
Nov 11 22:30:58 dnsmasq[236377]: query[A] www.googletagmanager.com from 192.168.2.79
Nov 11 22:30:58 dnsmasq[236377]: gravity blocked www.googletagmanager.com is 0.0.0.0
Nov 11 22:30:58 dnsmasq[236378]: query[HTTPS] www.googletagmanager.com from 192.168.2.79
Nov 11 22:30:58 dnsmasq[236378]: gravity blocked www.googletagmanager.com is NODATA
Nov 11 22:30:58 dnsmasq[236379]: query[A] eex-gateway.fr011.ttecfed.com from 192.168.2.79
Nov 11 22:30:58 dnsmasq[236380]: query[HTTPS] eex-gateway.fr011.ttecfed.com from 192.168.2.79
Nov 11 22:30:59 dnsmasq[236380]: failed to send TCP(read_write) packet: Connection prematurely closed by remote server
Nov 11 22:30:59 dnsmasq[236374]: forwarded eex-gateway.fr011.ttecfed.com to 127.0.0.1#5335
Nov 11 22:30:59 dnsmasq[236379]: forwarded eex-gateway.fr011.ttecfed.com to 127.0.0.1#5335
Nov 11 22:30:59 dnsmasq[236373]: forwarded eex-gateway.fr011.ttecfed.com to 127.0.0.1#5335
Nov 11 22:30:59 dnsmasq[236374]: reply eex-gateway.fr011.ttecfed.com is NODATA
Nov 11 22:30:59 dnsmasq[236373]: reply eex-gateway.fr011.ttecfed.com is 208.95.152.110
Nov 11 22:30:59 dnsmasq[236379]: reply eex-gateway.fr011.ttecfed.com is 208.95.152.110
Nov 11 22:30:59 dnsmasq[234203]: query[A] remote-data.asnapieu.com from 192.168.2.64
Nov 11 22:30:59 dnsmasq[234203]: gravity blocked remote-data.asnapieu.com is 0.0.0.0

I see that dnsmasq did have in above log, multiple Process ID's.
Is that normal?

If I search to dnsmasq I did not find it:

ubuntu@odroid:/var/log$ sudo find / -name dnsmasq
/snap/lxd/29353/bin/dnsmasq
/snap/lxd/28384/bin/dnsmasq
ubuntu@odroid:/var/log$ ll /snap/lxd/29353/bin/dnsmasq /snap/lxd/28384/bin/dnsmasq
-rwxr-xr-x 1 root root 451472 Apr 19 2024 /snap/lxd/28384/bin/dnsmasq*
-rwxr-xr-x 1 root root 451472 Jul 11 13:10 /snap/lxd/29353/bin/dnsmasq*
ubuntu@odroid:/var/log$ sudo apt install dnsmasq
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
dnsmasq-base
The following NEW packages will be installed:
dnsmasq dnsmasq-base
0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded.
Need to get 384 kB of archives.
After this operation, 977 kB of additional disk space will be used.
Do you want to continue? [Y/n] n
Abort.
ubuntu@odroid:/var/log$

The debug log is:
Your debug token is: https://tricorder.pi-hole.net/pS6hEQgI/

Any help and/or explanation would be appreciated.

I think I found it:
I use unbound 1.22 and IPV6.
But I did not set misc.etc_dnsmasq_d to True.
Now I again enable IPV6 in pihole and did not add DNS servers for IPV6 (only 127.0.0.1#5335).
I looks now that IPV6 is working and no error or warning messages any more.
I wait a couple of days for I conclude that it is solved.

Today, 13 november 2024, I did enable IPV6 enable again and I did got again the same error message in pihole.log and FTL.log:

2024-11-13 11:31:56.085 WARNING Connection error (127.0.0.1#5335): failed to send TCP(read_write) packet (Connection prematurely closed by remote server)
2024-11-13 11:31:56.088 WARNING Connection error (127.0.0.1#5335): failed to send TCP(read_write) packet (Connection prematurely closed by remote server)

pihole.log:
ubuntu@odroid:/var/log/pihole$ sudo grep 11:31:5 pihole.log
Nov 13 11:31:55 dnsmasq[271155]: query[AAAA] ipv4only.arpa from fd00::4c73:9445:44d5:c89a
Nov 13 11:31:55 dnsmasq[271156]: query[AAAA] ipv4only.arpa from fd00::4c73:9445:44d5:c89a
Nov 13 11:31:56 dnsmasq[271157]: query[AAAA] ipv4only.arpa from 192.168.2.79
Nov 13 11:31:56 dnsmasq[271158]: query[AAAA] ipv4only.arpa from 192.168.2.79
Nov 13 11:31:56 dnsmasq[271155]: failed to send TCP(read_write) packet: Connection prematurely closed by remote server
Nov 13 11:31:56 dnsmasq[271156]: failed to send TCP(read_write) packet: Connection prematurely closed by remote server
Nov 13 11:31:56 dnsmasq[271157]: forwarded ipv4only.arpa to 127.0.0.1#5335
Nov 13 11:31:56 dnsmasq[271158]: forwarded ipv4only.arpa to 127.0.0.1#5335
Nov 13 11:31:56 dnsmasq[271157]: reply ipv4only.arpa is NODATA-IPv6
Nov 13 11:31:56 dnsmasq[271158]: reply ipv4only.arpa is NODATA-IPv6
Nov 13 11:31:56 dnsmasq[234203]: query[AAAA] ipv4only.arpa from fd00::4c73:9445:44d5:c89a
Nov 13 11:31:56 dnsmasq[234203]: cached ipv4only.arpa is NODATA-IPv6
Nov 13 11:31:56 dnsmasq[271159]: query[AAAA] ipv4only.arpa from 192.168.2.79
Nov 13 11:31:56 dnsmasq[271159]: cached ipv4only.arpa is NODATA-IPv6
Nov 13 11:31:56 dnsmasq[271160]: query[AAAA] ipv4only.arpa from 192.168.2.79
Nov 13 11:31:56 dnsmasq[271160]: cached ipv4only.arpa is NODATA-IPv6
Nov 13 11:31:59 dnsmasq[234203]: query[AAAA] mobile.pipe.aria.microsoft.com from 192.168.2.72
Nov 13 11:31:59 dnsmasq[234203]: gravity blocked mobile.pipe.aria.microsoft.com is ::
Nov 13 11:31:59 dnsmasq[234203]: query[A] mobile.pipe.aria.microsoft.com from 192.168.2.72
Nov 13 11:31:59 dnsmasq[234203]: gravity blocked mobile.pipe.aria.microsoft.com is 0.0.0.0

Odroid pihole server IPV6 address:
inet6 fd00::21e:6ff:fe4a:83f4/64

Laptop IPV6 address:
fd00::6902:23c:77a6:3834

Laptop IPV4 address:
192.168.2.79

At earlier today, I got also this error:
FTL.log:
2024-11-13 01:07:47.387 ERROR Error while trying to close database: database is locked

In pihole.log I did see this:
pihole.log:
Nov 13 01:07:43 dnsmasq[234203]: query[A] remote-data.asnapieu.com from 192.168.2.71
Nov 13 01:07:43 dnsmasq[234203]: gravity blocked remote-data.asnapieu.com is 0.0.0.0
Nov 13 01:07:55 dnsmasq[234203]: query[AAAA] ssl.google-analytics.com from 192.168.2.77
Nov 13 01:07:55 dnsmasq[234203]: gravity blocked ssl.google-analytics.com is ::
Nov 13 01:07:55 dnsmasq[234203]: query[A] ssl.google-analytics.com from 192.168.2.77
Nov 13 01:07:55 dnsmasq[234203]: gravity blocked ssl.google-analytics.com is 0.0.0.0

See gap between line 2 and line 3.

unbound.log:
2024-11-13T01:06:44.643+01:00 unbound[253165:0] info: reply from <azure-dns.info.> 208.84.5.1#53
2024-11-13T01:06:44.643+01:00 unbound[253165:0] info: query response was ANSWER
2024-11-13T01:09:32.514+01:00 unbound[253165:0] info: resolving api.weather.com. AAAA IN
2024-11-13T01:09:32.521+01:00 unbound[253165:0] info: resolving api.weather.com. A IN
2024-11-13T01:09:32.529+01:00 unbound[253165:0] info: response for api.weather.com. A IN

See also here the gap between line 2 and line 3.

2

This means the remote end terminated the connection before it finished sending. This shouldn't happen but can happen for unreliable Internet connections or for buggy upstream servers.

Yes, absolutely. DNS requests are typically made over UDP. However, they can also be sent over TCP in which case FTL forks a dedicated worker for each (long-lived) connection. These forks get their own PIDs assigned.

This seems normal if - and really only if - you made no requests in between. I cannot confirm/deny this from the short pihole.log excerpt you have provided.

Question: Which IPv6 address did you specify for Pi-hole to use?

Please also note that there is no need to specify both IPv4 and IPv6 upstream server addresses to the same server. One of the two will suffice.

3

Question: Which IPv6 address did you specify for Pi-hole to use?

My IPV6 setup was some weeks ago as follows:

Also I enabled IPV6 on the pihole linux (ubuntu 2404 LTS).
That resulted that that server got an FE80: address.
In pihole GUI I Enabled: additional IPv6 support (SLAAC + RA).
I also added two lines to: Custom DNS servers.
These lines where: 2620:0:ccc::2 and 2620:0:ccd::2 (OpenDNS IPV6).
And I restarted DNS on pihole.
In unbound.conf I Enabled: do-ip6: yes and do-ip4: yes
and enabled: private-address: 192.168.2.0/24
and enabled: private-address: fd00::/8.
I restarted unbound.
In my Zyxel modem I activated IPV6 and added the same two IPV6 DNS servers as I did in pihole (2620:0:ccc::2 and 2620:ccd::2).
I applied the changes on the modem.
That resulted that als devices got an FD00: IPV6 address.

It turns out that I got more error in the pihole.log.
I realized that unbound and pihole now both try to resolve IPV6 DNS trafic.

Please also note that there is no need to specify both IPv4 and IPv6 upstream server addresses to the same server. One of the two will suffice.
I not aware that I used them both.

A few days ago I did changed the setup as follows:

Also I enabled IPV6 on the pihole linux (ubuntu 2404 LTS).
That resulted that that server got an FE80: address.
In pihole GUI I Enabled: additional IPv6 support (SLAAC + RA).
I also removed two lines from: Custom DNS servers.
These lines where: 2620:0:ccc::2 and 2620:0:ccd::2.
Now the only remainimg line is 127.0.0.1#5335.
And I restarted DNS on pihole.
In unbound.conf I Enabled: do-ip6: yes and do-ip4: yes
and enabled: private-address: 192.168.2.0/24
and enabled: private-address: fd00::/8.
I restarted unbound.
In my Zyxel modem I deactivated IPV6.
I applied the changes on the modem.
That resulted that als devices got an FD00: IPV6 address.
And the errors where gone.

Until so now and then I got these messages:
failed to send TCP(read_write) packet (Connection prematurely closed by remote server)

You explained how that can caused.

But a got an other error in the diagnosting window:

2024-11-13 17:47:42.804 WARNING Connection error (127.0.0.1#5335): failed to send TCP(read_write) packet (Connection prematurely closed by remote server)

pihole.log:
ubuntu@odroid:/var/log/pihole$ sudo grep 17:47:42 pihole.log
Nov 13 17:47:42 dnsmasq[234203]: query[AAAA] my.microsoftpersonalcontent.com from 192.168.2.72
Nov 13 17:47:42 dnsmasq[234203]: cached-stale my.microsoftpersonalcontent.com is
Nov 13 17:47:42 dnsmasq[234203]: cached-stale lists-e.tm-rt.sharepoint.com is
Nov 13 17:47:42 dnsmasq[234203]: cached-stale 189736-ipv4mte.gr.global.aa-rt.sharepoint.com is
Nov 13 17:47:42 dnsmasq[234203]: cached-stale 189736-ipv4mte.farm.dprodmgd104.aa-rt.sharepoint.com is
Nov 13 17:47:42 dnsmasq[234203]: cached-stale 189736-ipv4mteg.farm.dprodmgd104.sharepointonline.com.akadns.net is
Nov 13 17:47:42 dnsmasq[234203]: cached-stale 189736-ipv4.farm.dprodmgd104.aa-rt.sharepoint.com.dual-spov-0006.spov-msedge.net is
Nov 13 17:47:42 dnsmasq[234203]: cached-stale dual-spov-0006.spov-msedge.net is NODATA-IPv6
Nov 13 17:47:42 dnsmasq[234203]: forwarded my.microsoftpersonalcontent.com to 127.0.0.1#5335
Nov 13 17:47:42 dnsmasq[234203]: query[A] my.microsoftpersonalcontent.com from 192.168.2.72
Nov 13 17:47:42 dnsmasq[234203]: cached-stale my.microsoftpersonalcontent.com is
Nov 13 17:47:42 dnsmasq[234203]: cached-stale lists-e.tm-rt.sharepoint.com is
Nov 13 17:47:42 dnsmasq[234203]: cached-stale 189736-ipv4mte.gr.global.aa-rt.sharepoint.com is
Nov 13 17:47:42 dnsmasq[234203]: cached-stale 189736-ipv4mte.farm.dprodmgd104.aa-rt.sharepoint.com is
Nov 13 17:47:42 dnsmasq[234203]: cached-stale 189736-ipv4mteg.farm.dprodmgd104.sharepointonline.com.akadns.net is
Nov 13 17:47:42 dnsmasq[234203]: cached-stale 189736-ipv4.farm.dprodmgd104.aa-rt.sharepoint.com.dual-spov-0006.spov-msedge.net is
Nov 13 17:47:42 dnsmasq[234203]: cached-stale dual-spov-0006.spov-msedge.net is 13.107.137.11
Nov 13 17:47:42 dnsmasq[234203]: cached-stale dual-spov-0006.spov-msedge.net is 13.107.139.11
Nov 13 17:47:42 dnsmasq[234203]: forwarded my.microsoftpersonalcontent.com to 127.0.0.1#5335
Nov 13 17:47:42 dnsmasq[273954]: query[AAAA] my.microsoftpersonalcontent.com from 192.168.2.72
Nov 13 17:47:42 dnsmasq[273954]: cached-stale my.microsoftpersonalcontent.com is
Nov 13 17:47:42 dnsmasq[273954]: cached-stale lists-e.tm-rt.sharepoint.com is
Nov 13 17:47:42 dnsmasq[273954]: cached-stale 189736-ipv4mte.gr.global.aa-rt.sharepoint.com is
Nov 13 17:47:42 dnsmasq[273954]: cached-stale 189736-ipv4mte.farm.dprodmgd104.aa-rt.sharepoint.com is
Nov 13 17:47:42 dnsmasq[273954]: cached-stale 189736-ipv4mteg.farm.dprodmgd104.sharepointonline.com.akadns.net is
Nov 13 17:47:42 dnsmasq[273954]: cached-stale 189736-ipv4.farm.dprodmgd104.aa-rt.sharepoint.com.dual-spov-0006.spov-msedge.net is
Nov 13 17:47:42 dnsmasq[273954]: cached-stale dual-spov-0006.spov-msedge.net is NODATA-IPv6
Nov 13 17:47:42 dnsmasq[234203]: query[AAAA] mobile.events.data.microsoft.com from 192.168.2.72
Nov 13 17:47:42 dnsmasq[234203]: cached-stale mobile.events.data.microsoft.com is
Nov 13 17:47:42 dnsmasq[234203]: cached-stale mobile.events.data.trafficmanager.net is
Nov 13 17:47:42 dnsmasq[234203]: forwarded mobile.events.data.microsoft.com to 127.0.0.1#5335
Nov 13 17:47:42 dnsmasq[234203]: query[A] mobile.events.data.microsoft.com from 192.168.2.72
Nov 13 17:47:42 dnsmasq[234203]: cached-stale mobile.events.data.microsoft.com is
Nov 13 17:47:42 dnsmasq[234203]: cached-stale mobile.events.data.trafficmanager.net is
Nov 13 17:47:42 dnsmasq[234203]: cached-stale onedscolprdwus08.westus.cloudapp.azure.com is 20.189.173.9
Nov 13 17:47:42 dnsmasq[234203]: forwarded mobile.events.data.microsoft.com to 127.0.0.1#5335
Nov 13 17:47:42 dnsmasq[273954]: failed to send TCP(read_write) packet: Connection prematurely closed by remote server
Nov 13 17:47:42 dnsmasq[234203]: forwarded my.microsoftpersonalcontent.com to 127.0.0.1#5335
Nov 13 17:47:42 dnsmasq[234203]: reply error is SERVFAIL
Nov 13 17:47:42 dnsmasq[234203]: reply mobile.events.data.microsoft.com is
Nov 13 17:47:42 dnsmasq[234203]: reply mobile.events.data.trafficmanager.net is
Nov 13 17:47:42 dnsmasq[234203]: reply onedscolprdweu14.westeurope.cloudapp.azure.com is 52.178.17.235
Nov 13 17:47:42 dnsmasq[234203]: reply mobile.events.data.microsoft.com is
Nov 13 17:47:42 dnsmasq[234203]: reply mobile.events.data.trafficmanager.net is
Nov 13 17:47:42 dnsmasq[234203]: reply onedscolprdcus23.centralus.cloudapp.azure.com is NODATA-IPv6

unbound.log:
2024-11-13T17:47:42.792+01:00 unbound[253165:0] info: query response was CNAME
2024-11-13T17:47:42.792+01:00 unbound[253165:0] info: resolving my.microsoftpersonalcontent.com. AAAA IN
2024-11-13T17:47:42.792+01:00 unbound[253165:0] info: response for mobile.events.data.microsoft.com. A IN
2024-11-13T17:47:42.792+01:00 unbound[253165:0] info: reply from <azure.com.> 13.107.206.39#53
2024-11-13T17:47:42.792+01:00 unbound[253165:0] info: query response was nodata ANSWER
2024-11-13T17:47:42.792+01:00 unbound[253165:0] info: response for mobile.events.data.microsoft.com. AAAA IN
2024-11-13T17:47:42.792+01:00 unbound[253165:0] info: reply from <trafficmanager.net.> 150.171.10.240#53
2024-11-13T17:47:42.792+01:00 unbound[253165:0] info: query response was CNAME
2024-11-13T17:47:42.792+01:00 unbound[253165:0] info: resolving mobile.events.data.microsoft.com. AAAA IN
2024-11-13T17:47:42.805+01:00 unbound[253165:0] info: response for my.microsoftpersonalcontent.com. AAAA IN
2024-11-13T17:47:42.805+01:00 unbound[253165:0] info: reply from <spov-msedge.net.> 13.107.137.1#53
2024-11-13T17:47:42.805+01:00 unbound[253165:0] info: query response was ANSWER
2024-11-13T17:47:42.806+01:00 unbound[253165:0] info: response for mobile.events.data.microsoft.com. AAAA IN
2024-11-13T17:47:42.806+01:00 unbound[253165:0] info: reply from <azure.com.> 150.171.16.39#53
2024-11-13T17:47:42.806+01:00 unbound[253165:0] info: query response was REFERRAL
2024-11-13T17:47:42.806+01:00 unbound[253165:0] info: response for mobile.events.data.microsoft.com. A IN
2024-11-13T17:47:42.806+01:00 unbound[253165:0] info: reply from <azure.com.> 150.171.16.39#53

4

They did that before. Please note that IPv4 and IPv6 addresses and domain records are entirely separate things!

You can resolve the IPv4 address (A DNS record) and IPv6 address (AAAA DNS record) of any address either over IPv4 or IPv6 - or both. Your devices may just have started trying to resolve IPv6 addresses because they IPv6 connectivity was detected but you can happily continue to use only IPv4 addresses as upstreams for your Pi-hole. Even more when it is a local upstream such as unbound.