Regression #14368: Intermittent DNS failures - pfSense - pfSense bugtracker

Custom queries

2.4.5-p1 - Resolved/Closed
2.5.0 - Resolved/Closed
2.5.1 - Resolved/Closed
2.5.2 - Resolved/Closed
2.6.0 - Resolved/Closed
2.7.0 - Resolved/Closed
2.7.1 - All Open Issues
2.7.1 - Resolved/Closed
2.7.2 - Resolved/Closed
2.8.0 - All Open Bugs
2.8.0 - All Open Features
2.8.0 - All Open Issues
2.8.0 - All Open Regressions
2.8.0 - Feedback
2.8.0 - Needs Attention
2.8.0 - New/Confirmed
2.8.0 - Pull Requests
2.8.0 - Regressions affecting 2.7.0
2.8.0 - Resolved/Closed
21.02.2/2.5.1 - Resolved/Closed
21.05 Plus - All Closed Issues
21.05.1 Plus Target - All Closed Issues
21.05.1 Target - All Closed Issues
22.01 Plus - All Closed Issues
22.01 Target - All Closed Issues
22.05 Plus - All Closed Issues
22.05 Target - All Closed Issues
23.01 Plus - All Closed Issues
23.01 Target - All Closed Issues
23.05 Plus - All Closed Issues
23.05 Target - All Closed Issues
23.05.1 Plus - All Closed Issues
23.05.1 Target - All Closed Issues
23.09 Plus - All Closed Issues
23.09 Target - All Closed Issues
23.09.1 Plus - All Closed Issues
23.09.1 Plus - All Open Issues
23.09.1 Target - All Closed Issues
23.09.1 Target - All Open Issues
24.03 Plus - All Closed Issues
24.03 Plus - All Open Issues
24.03 Plus - Feedback Issues
24.03 Plus - Needs Attention/Work
24.03 Plus - New/Confirmed/In Progress Issues
24.03 Plus - Pull Request Review
24.03 Plus - Waiting on Merge
24.03 Target - All Closed Issues
24.03 Target - All Open Issues
All Open Issues assigned to Me
All Open Pull Requests
Any Target - All Open Regressions
Any Target - Feedback Issues
CE-Next - All Closed Issues (Move to specific target)
CE-Next - All Open Issues
CE-Next - Feedback (Likely needs target changed)
New Issues by Category - Future Target
New Issues by Category - No Target
New Issues by Category - No Target+Future
No Target - All Open Issues (Base Only)
No Target - New Issues (Base Only)
No Target - New Issues (Base and Packages)
Release Notes - Plus Target Version (DO NOT EDIT)
Release Notes - Target Version (DO NOT EDIT)

Actions

Copy link

Regression #14368

closed

Intermittent DNS failures

Added by Doug Miles 12 months ago. Updated 12 months ago.

Status:

Duplicate

Priority:

Normal

Assignee:

Category:

DNS Resolver

Target version:

Start date:

Due date:

% Done:

Estimated time:

Plus Target Version:

Release Notes:

Default

Affected Version:

Affected Architecture:

Description

When DNS Resolver is set to forwarding mode and "Use SSL/TLS for outgoing DNS Queries to Forwarding Servers" is enabled, there are intermittent failures. I can't replicate it on demand, but I've noticed it most on iOS devices, often when opening the App Store and it said it is unable to connect. In the past, it does seem that macOS/iOS tends to cache and hang on to failed DNS resolutions, so maybe that's why I see it more there.

Anyway, this issue is discussed in the posts below:

Related issues

Is duplicate of Bug #14056: DNS Resolver experiences intermittent resolution failures with SSL over TLS due to ASLR

Closed

Christian McDonald

Actions

Issue # Delay: days Cancel

History
Notes
Property changes

Actions

Copy link

Updated by Doug Miles 12 months ago

This is actually for 23.01

That somehow posted before I had finished typing and checking everything. Here are the links I was trying to paste in:

https://forum.netgate.com/topic/177979/23-01-breaks-dns-resolver-and-pfblocker/23

https://forum.netgate.com/topic/178413/major-dns-bug-23-01-with-quad9-on-ssl

I'm using 1.1.1.2/1.0.0.2 as my upstream DNS servers, with "security.cloudflare-dns.com" for the TLS hostname. 9.9.9.9 is also commonly used in the threads I linked. After a week or so of testing, enabling and disabling "Use SSL/TLS for outgoing DNS Queries to Forwarding Servers" causes and resolves the issue, respectively. First noticed immediately after the upgrade to 23.01.

Actions

Copy link

Updated by Brad Smith 12 months ago

I've noticed the same since 2.7 snapshots for a long time. At first, I suspected my WiFi system but I eventually ruled that out. I too have noticed that iOS devices seem to be worst affected for some reason (maybe something to do with the way they retry DNS requests).

I use 1.1.1.1/1.0.0.1 SSL/TLS

Actions

Copy link