Where is this DNS resolution IP coming from?

[Linwood]

This seems like a simple question but I am baffled.

I am running unbound and dns and dhcp4, but not adguard.

I created a new esp32 device, it probably pulled a dhcp address at some point, but I gave it a static address of 192.168.130.53.

Now OPNsense as a DNS server is giving out a pair of addresses for its name:

Code Select Expand

Name:    frontdoorpanel.xxxxx.com
Addresses:  192.168.130.53
          192.168.130.72


Simple (I think), the DHCP is hanging around.  But it's not there, even with show expired (I am not certain it ever pulled a DHCP address, that's supposition, usually these things do and I just delete them).

I have looked in the Unbound overrides and only the .53 address is there.  I have looked in DHCP leases and DHCP reservations, it is not in either place. 

There are no unbound aliases defined.

The above is nslookup, so it's not some broadcast mDNS answer from a device.

I asked unbound to log queries and replies and it does so but just basic info, at least I do not see where the detail may be. But showing details in nslookup shows it responding with both.

It's really acting like there is a unbound override in there (or a dhcp4 address), but ... it's not showing up.

I have restarted dhcp4, unbound, and rebooted the OPNsense firewall (in that order) and nothing changes.

I don't know if there is a text file where overrides are stored -- is there?   That I could search?

Where else could this value be?  What could I be missing?  This looks so simple.

Opnsense 23.7.8 on FreeBSD 13.2-Release-p5 on Intel.

Any advice?   It's not actually causing much of a problem, just a network monitoring device (zabbix) is complaining about the DNS vs IP mismatch since it expects only the .53.

Linwood

[sja1440]

I once had a similar problem.  I do not think it is of use to you, but in my case, the undesired ipv4 was coming from an assignment made to the dhcp server attached to a disabled interface.