DNS Update Issue
-
powered the Pi-Hole back on and look..
-
Going to get my daughter's Surface running Windows 10 to verify for everyone.
-
@scottalanmiller said in DNS Update Issue:
@Obsolesce said in DNS Update Issue:
So, @scottalanmiller , back to using PING again, because it's the easiest way to get hte computer to make DNS requests. No flushdns is required after the initial ones if i"m using different and uncached hostnames to get the client to perform DNS lookups.
Edit: Nirsoft has a DNS lookup tool, I'll try that
Okay, so if we avoid the cache, and check logs to see what ping is doing...
Did it behave the same, with an automatic failover and, more importantly, fail back?
I'll try it with ping instead of nirsoft DNSDataView. I have a feeling that program is way smarter than Windows ping and nslookup and will use whatever DNS server it can. So I'll only use it to verify the hostnames i ping arent' cached.
-
@JaredBusch I used a watch command with nslookup on Fedora, which is neat because it just... updates.
-
I opened the left powershell window and did the lookup.
shutdown the Pi-Hole and typed again.
Then I opened the second window.Just in case maybe nslookup opened after the DNS server was offline would work. Nope.Piss off Windows.
-
So pretty much we should also be using Linux to troubleshoot Windows too.
-
@scottalanmiller said in DNS Update Issue:
@JaredBusch I used a watch command with nslookup on Fedora, which is neat because it just... updates.
Right, but that is technically a new instance of the command each time. I was using the opened command instance proving nothing had to even be re-executed.
-
Final results:
I used Nirsoft DNSDataView to verify that any hostname I query is not in the Windows DNS Cache.
I blocked all DC/DNS server IPs in the local firewal, and verified DNS does not work.
- I test this by clearing the local DNS cache (
ipconfig /flushdns) then trying to ping something by name. This proved as a good test, becasue I was unable to ping anything by hostname. The PING failed because a DNS server could not be contacted in order to get the IP of the host I was trying to ping by name.
I enabled Debug Logging on both DC/DNS servers (DC/DNS01 and DC/DNS02). I had both logs up in tail mode so I can see ALL DNS querys to the server from my test workstation only.
Then I unblocked only DC/DNS02, and tried pinging something by hostname only. This forces the client to do a DNS lookup so it can ping the target.
- I tested this by unblocking DC/DNS02, then performing a ping to a non-cached hostname. It was a successful PING, and DNS lookup occurred on DC/DNS02, confirmed in log.
I now unblocked the primary DC (DC/DNS01), and performed a ping to a non-cached hostname.
I performed several more pings shown below, and the DNS server that was used to perform the DNS query, as well as the time.
ping 1 -> DC/DNS02 (11:21 am)
ping 2 -> DC/DNS02 (11:22 am)
ping 3 -> DC/DNS02 (11:25 am)
ping 4 -> DC/DNS02 (11:30 am)
ping 5 -> DC/DNS02 (11:33:31 am)
Ping X -> DC/DNS01 (11:33:57 am) On DC/DNS01 I noticed an entry, which tells me Windows automatically set it back to be used, confirmed below:
ping 6 -> DC/DNS01 (11:34:17 am)
Tesing shows that Windows does not immediately fail-back to the primary DNS server once it becomes available, and doesn't do it automatically for about 15 minutes without some kind of network stack reset or computer reboot.
Windows will automatically fail-back to primary DNS server after about 15 minutes.
Now there's something to search the internet for, and as such, confirmed that 15 minutes is when it happens automatically.
- I test this by clearing the local DNS cache (
-
@Obsolesce interesting, so very different results than people had been saying that they were getting in Windows environments. But much more logical and expected.
-
Wonder if you can edit that in your registry
-
@scottalanmiller said in DNS Update Issue:
@Obsolesce interesting, so very different results than people had been saying that they were getting in Windows environments. But much more logical and expected.
I’m not sure I follow.
Once you notice there is a problem, who would wait 15 mins to see if windows flips back? Definitely not me. I’ll have /release/renew and or rebooted by then.
If there is no report/realized issue, then the question is, is there really a problem?
-
@Dashrender said in DNS Update Issue:
is there really a problem?
No, people just like to argue about invented issues.
-
@Dashrender said in DNS Update Issue:
@scottalanmiller said in DNS Update Issue:
@Obsolesce interesting, so very different results than people had been saying that they were getting in Windows environments. But much more logical and expected.
I’m not sure I follow.
Once you notice there is a problem, who would wait 15 mins to see if windows flips back? Definitely not me. I’ll have /release/renew and or rebooted by then.
If there is no report/realized issue, then the question is, is there really a problem?
If people claim "forever" and don't test for even fifteen minutes, I think we have a serious problem with reporting "forever." That's not even "a long time." Longer than necessary, but not so long that you could reasonably claim that it doesn't recover on its own.
-
@Obsolesce said in DNS Update Issue:
@Dashrender said in DNS Update Issue:
is there really a problem?
No, people just like to argue about invented issues.
Which is why I questioned all the reports of it. It didn't seem plausible that Windows worked as poorly as people were claiming with the beliefs that it would flip at random, and that it would stay forever. Neither is really reasonable. Why it waits fifteen minutes? That's something hopeful a registry edit can lower. I'd want more like one minute, but it's still pretty reasonable for desktop users, it's not a long time at all.
-
@scottalanmiller the issue with
nslookupbeing useless is stupid though. -
@JaredBusch said in DNS Update Issue:
@scottalanmiller the issue with
nslookupbeing useless is stupid though.Agreed, that's really messed up.
