1

I am trying to troubleshoot some DNS issues and I am starting by trying to trace my DNS lookups using dig +trace. Im getting some weird results. If do a normal dig to my unbound resolver.

dig @192.168.20.1 +notrace pfsense.org

I get a normal result.

doubleh2admin@doubleh2:~$ dig @192.168.20.1 +notrace pfsense.org

; <<>> DiG 9.11.4-3ubuntu5.1-Ubuntu <<>> @192.168.20.1 +notrace pfsense.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 17123
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;pfsense.org.                   IN      A

;; ANSWER SECTION:
pfsense.org.            299     IN      A       208.123.73.69

;; Query time: 1010 msec
;; SERVER: 192.168.20.1#53(192.168.20.1)
;; WHEN: Wed Apr 03 23:29:37 UT

However if I then try to trace the request

dig @192.168.20.1 +trace pfsense.org

I get a connection timeout.

doubleh2admin@doubleh2:~$ dig @192.168.20.1 +trace pfsense.org

; <<>> DiG 9.11.4-3ubuntu5.1-Ubuntu <<>> @192.168.20.1 +trace pfsense.org
; (1 server found)
;; global options: +cmd
.                       85923   IN      NS      a.root-servers.net.
.                       85923   IN      NS      l.root-servers.net.
.                       85923   IN      NS      b.root-servers.net.
.                       85923   IN      NS      c.root-servers.net.
.                       85923   IN      NS      g.root-servers.net.
.                       85923   IN      NS      i.root-servers.net.
.                       85923   IN      NS      m.root-servers.net.
.                       85923   IN      NS      d.root-servers.net.
.                       85923   IN      NS      j.root-servers.net.
.                       85923   IN      NS      h.root-servers.net.
.                       85923   IN      NS      e.root-servers.net.
.                       85923   IN      NS      k.root-servers.net.
.                       85923   IN      NS      f.root-servers.net.
.                       85923   IN      RRSIG   NS 8 0 518400 20190416170000 20190403160000 25266 . aJEQERj+M077D4YytUEwfqBW8VighhMROJ1VqNRLu+eRwE3qVj1vT8QP Bi01SUibk5AET5mHva3Avz0aEPDqJZULr3IbxUwV6Gpaw7tuNyjNvB/X ZkhySRGCBubMKfc5uJkJhEEh3JGG2S5SBA2+f9JBLKzW/YiGTU2weyI1 QKA3ZY64JNk9xjBZF/6MnHfYmxYU5I7o+5IaqdMhdhfmh5PFvGtXgpeh ZQ0e203pNI8MjZMC5t9C/ucfXl4XGuGHkvKh+rvdv++t4g2fLRR1mO0K 39EfZf8lt623isLaDhifUbzdJtO2AIeb3GSE6aQCky32s3/tMyFVg8sA ByLeNw==
;; Received 525 bytes from 192.168.20.1#53(192.168.20.1) in 0 ms


;; connection timed out; no servers could be reached

Does anyone have any idea what is going on here?

Marc Henning
  • 11
  • 1
  • 2
  • 1
    Looks to me like you can't reach any DNS servers but your own. At least you're not reaching the root servers. –  Apr 03 '19 at 23:52
  • then why does a +notrace return a valid response? – Marc Henning Apr 03 '19 at 23:55
  • Because it asks your local name server for the answer. +trace means it asks for your server who to ask. +notrace means you do the work, not me. +notrace (the default even if you don't specify) behaves like a client, +trace follows the delegation like a server. –  Apr 03 '19 at 23:56
  • When you put it that way it made it clear that it was then a firewall issue. Thanks for the explanation – Marc Henning Apr 04 '19 at 00:28

0 Answers0