DNS unbound servfail errors

Networking
1

Hello,
i have a strange problem with DNS unbound:
IPFire 2.27 (x86_64) - Core Update 168
Static IP configuration via TV cable Modem to vodafone

If i call some Websites, here eg “disapo.de” , i get the error “site not found”
If i refresh the DNS server configuration by clicking “save” in the web-gui, the sites will be found.
If i wait 5 to 10 minutes and call the site again, i again get the error “site not found”
This happens only on very few, but always the same, sites.

The problem persists with other DNS servers.

Is there any idea, what to do?
thanks a lot for your help.

1 Like
2

Hi @error1533.

Have You Router or cable modem?.

Vodafone have something called “SECURE DNS” or similar how impossibilite to use another DNSs. I think is in Router mode. If You have in this mode, You need unable this. If that is not the case, maybe another guy can help you.

It’s an idea.

Greetings.

1 Like
3

Hi Roberto,

as i wrote, TV cable modem with multiple fixed IP’s.

Next query, a few minutes later

|11:00:41|unbound: [1814:0]|error: SERVFAIL <www.disapo.de. A IN>: all the configured stub or forward serve rs failed, at zone . from (inet_ntop_error) upstream server timeout|

At this time mark ( |10:15:52 ) the query works
10:15:52 unbound: [1814:0] info: generate keytag query _ta-4a5c-4f66. NULL IN
10:15:52 unbound: [1814:0] info: start of service (unbound 1.14.0).
10:15:52 unbound: [1814:0] notice: init module 1: iterator
10:15:52 unbound: [1814:0] notice: init module 0: validator
10:15:52 unbound: [1814:0] notice: Restart of unbound 1.14.0.
10:15:52 unbound: [1814:0] info: 32.000000 64.000000 1
10:15:52 unbound: [1814:0] info: 16.000000 32.000000 6
10:15:52 unbound: [1814:0] info: 8.000000 16.000000 1
10:15:52 unbound: [1814:0] info: 4.000000 8.000000 5
10:15:52 unbound: [1814:0] info: 2.000000 4.000000 1
10:15:52 unbound: [1814:0] info: 0.524288 1.000000 1
10:15:52 unbound: [1814:0] info: 0.131072 0.262144 5
10:15:52 unbound: [1814:0] info: 0.065536 0.131072 22
10:15:52 unbound: [1814:0] info: 0.032768 0.065536 25
10:15:52 unbound: [1814:0] info: 0.016384 0.032768 27
10:15:52 unbound: [1814:0] info: 0.008192 0.016384 20
10:15:52 unbound: [1814:0] info: 0.002048 0.004096 1
10:15:52 unbound: [1814:0] info: 0.000000 0.000001 25
10:15:52 unbound: [1814:0] info: lower(secs) upper(secs) recursions
10:15:52 unbound: [1814:0] info: [25%]=0.0118784 median[50%]=0.0309476 [75%]=0.0863884
10:15:52 unbound: [1814:0] info: histogram of recursion processing times
10:15:52 unbound: [1814:0] info: average recursion processing time 1.630828 sec
10:15:52 unbound: [1814:0] info: server stats for thread 0: requestlist max 3 avg 0.277778 exceeded 0 jost led 0
10:15:52 unbound: [1814:0] info: server stats for thread 0: 172 queries, 28 answers from cache, 144 recurs ions, 0 prefetch, 0 rejected by ip ratelimiting
10:15:52 unbound: [1814:0] info: service stopped (unbound 1.14.0).
10:12:14 unbound: [1814:0] error: SERVFAIL <www.disapo.de. A IN>: all the configured stub or forward serve rs failed, at zone . upstream server timeout
4

This is saying that unbound had a timeout waiting for a response from the upstream DNS server.

Unbound then won’t use that server for a short while and will try one of the other dns servers from the list you have defined and enabled. Sometimes servers can timeout because they are very busy but will be able to respond again after a short while. Alternatively if the dns server has had some form of outage then it will have repetitive fails. Unbound will then mark that dns server down in terms of using it.

It could be that the specific website(s) you are trying to access have some problem with their dns records and it is taking too long to resolve. I am not familiar enough with the DNS system to be sure on that.

Do you have multiple dns servers listed and enabled in the IPFire DNS Server page?

If yes then I don’t understand why the timeout would persist across other dns servers unless there is some problem with the dns records for that website.

When unbound fails to get the dns info and you get a site not found error, does that stay with that error when you repetitively try and access it until you re-select the dns servers on the IPFire wui page. If yes, then when you have the problem try running a dig or kdig command on the website to see what messages come back. There might be a bit more info than what unbound shows.

2 Likes
5

Hello, thank you for your reply.

I am using 8.8.8.8 and 8.8.4.4 as DNS servers. I tryed others, but always same result.

DIG says :
disapo.de. 300 IN A 51.89.126.194
disapo.de. 300 IN A 145.239.136.54

The websites that i cannot reach are availeble. If i try over a different IP connection, everything works fine.

6

Assuming you are using UDP
Have you tried switching to TCP?

7

Thank you,
i just tried TCP, no change, same problem.
Changed back to UDP

If i do a DIG to the missing website, the output of dig on the firewall itself does not change, before or after the problem reappears.

8

Hello there,

i finally found thr cause, since my Mega-Account stopt working as well.
Disabeling the intrusion-detection on the green interface fixed tht problem.
As described here:

2 Likes