dnsmasq + dnssec: DNS resolution/conversion works only partially

[cdr1981]

I have a very unusual problem with dnscrypt-proxy v2. The name conversion works only partially. The resolution of the domain name ending in .org does not work on the client. If I enter this directly at the console of pihole then the resolution works correctly.

---

SSH Console at Pihole:

root@pi-hole:/opt/dnscrypt-proxy# ./dnscrypt-proxy -resolve google.org
Resolving [google.org]

Domain exists: yes, 4 name servers found
Canonical name: google.org.
IP addresses: 216.239.32.27, 2001:4860:4802:32::1b
TXT records: v=spf1 include:_spf.google.com ~all
Resolver IP: 172.253.11.1

root@pi-hole:/opt/dnscrypt-proxy#

at Windows Client with Error:

C:\Users\Administrator>nslookup google.org
Server: pi-hole.intranet.lan
Address: 192.168.128.3
*** google.org wurde von pi-hole.intranet.lan nicht gefunden: Unspecified error.
C:\Users\Administrator>

On the other hand, the resolution of, for example, com domains works flawlessly.

C:\Users\Administrator>nslookup google.com
Server: pi-hole.intranet.lan
Address: 192.168.128.3

Nicht autorisierende Antwort:
Name: google.com
Addresses: 2a00:1450:400a:800::200e
216.58.215.238
C:\Users\Administrator>

If I deactivate dnscrypt proxy at the pihole and make the name resolution conventionally over pihole and port 53 let then work also the domains with the extension .org

C:\Users\Administrator>nslookup google.org
Server: pi-hole.intranet.lan
Address: 192.168.128.3

Nicht autorisierende Antwort:
Name: google.org
Addresses: 2001:4860:4802:32::1b
216.239.32.27
C:\Users\Administrator>

In dnscrypt proxy v2 I have no blacklist active. I have used version 2.0.19 and 2.0.27
Unfortunately I have no idea what causes this problem. That the resolution of .org domains works directly on pihole with dnscrypt. On the other hand, not on the client. On the other hand, domains with endings .com or .ch and so on also work on the client. I deleted the cache each time. The host file on the client is empty.

I hope someone can help in solving this problem. Thank you very much

[jedisct1]

Can you try disabling DNSSEC on pi-hole (not in dnscrypt-proxy, but on fldns, dnsmasq or whatever it's called)?

[cdr1981]

Now it works. In order to be able to resolve .org domains as well, DNSSEC must be deactivated in Pihole. Strangely, it only affected the .org domains. But now it works and thanks for the help.

[miquecg]

Can you try disabling DNSSEC on pi-hole (not in dnscrypt-proxy, but on fldns, dnsmasq or whatever it's called)?

I've been experiencing similar issues when DNSSEC is active in dnsmasq, primarily with .org domains also. Is there any known problem on dnscrypt-proxy for this type of requests? With public servers like Cloudflare for example, DNSSEC seems to work fine.

I have the impression that it could be happening only with some resolvers in particular. The issue is not always reproducible and dnscrypt-proxy doesn't use the same server for every request, at least by default.

[jedisct1]

When DNSSEC is enabled, the response for org is very large, and may be truncated. In which case the client is assumed to retry over TCP.

Maybe dnsmasq doesn't support that properly?

Truncated responses from dnscrypt-proxy don't have the DNSSEC bit set (only real responses), maybe this is what confuses dnsmasq.

[miquecg]

I've found this that could mean a problem with some servers but not 1.1.1.1:

What appears to be happening is that the initial response from 8.8.8.8 is getting dropped, causing dnsmasq to timeout and fallback to using a smaller (1280 byte) maximum which is then too small for the response and results in truncation and subsequent fallback to TCP. Whereas the responses from 1.1.1.1 are truncated from the beginning, perhaps because that server supports a smaller maximum UDP response size that doesn't result in fragmentation. You could verify this with a packet capture if you were so inclined

https://serverfault.com/questions/979277/dnsmasq-dnssec-udp-issue-on-google-compute-engine/979341#979341

I've seen messages in dnsmasq logs about reduced packet size when sending queries through dnscrypt-proxy, which does load balancing between available servers. For the moment this is not the case if I use Cloudflare instead of the proxy.

oct 09 20:20:59 dnsmasq[618]: reducing DNS packet size for nameserver 127.0.0.1 to 1280

[miquecg]

Since 2.0.28 update the issue seems to be gone. Both dnsmasq and dnscrypt-proxy work fine together with DNSSEC enabled.