DNS issues with certain sites like netflix, spotify, usps and even opnsense.org

[rgonzales98]

This initially started with netflix and spotify not working on my TV and stating no internet connection even though everything else was working. I have tried to find a solution to this but nothing is working :/ . Netflix has started working after i have disabled ipv6 but whenever i ping netflix.com it still gives me a timeout response as if the dns is not responding with a valid IP!!!  I have read that maybe some websites with load balancers are not responding with the correct IP address or just overall not responding at all to query requests. I am a beginner so ive just been following basic tutorials on how to set this up. Currently allowing all traffic on my firewall LAN for ipv4 so its not an issue with my firewall rules.

I'm either getting a ERR_CONNECTION_TIMED_OUT (opnsense.org) or DNS_PROBE_FINISHED_NXDOMAIN(usps.com).

I was wanting to stick with my ISP DNS and keep my DNS config simple using unbound but maybe thats the issue? Any recommendations on what i should do to fix this? I dont have an special DNS settings setup. I have included screenshots of my DNS settings and general settings. I have been dealing with this for hours.

[OPNenthu]

I'm not having issues on the other sites you mentioned, but since yesterday many Netflix domains are not resolving in Unbound (recursive mode) and it's not due to block lists.  See screenshots.

Local resolver returning NXDOMAIN:

Code: [Select]

$ dig help.netflix.com

; <<>> DiG 9.18.28-1~deb12u2-Debian <<>> help.netflix.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 37074
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;help.netflix.com.              IN      A

;; ANSWER SECTION:
help.netflix.com.       300     IN      CNAME   help.dradis.netflix.com.
help.dradis.netflix.com. 60     IN      CNAME   help.us-east-2.internal.dradis.netflix.com.

;; AUTHORITY SECTION:
dradis.netflix.com.     60      IN      SOA     e.ns.nflxso.net. nicadmin.netflix.com. 1732744401 16384 2048 1048576 60

;; Query time: 43 msec
;; SERVER: 192.168.40.1#53(192.168.40.1) (UDP)
;; WHEN: Wed Nov 27 17:02:57 EST 2024
;; MSG SIZE  rcvd: 169


Same query working with public DNS (DoH):

Code: [Select]

$ dig @1.1.1.1 help.netflix.com +https

; <<>> DiG 9.18.28-1~deb12u2-Debian <<>> @1.1.1.1 help.netflix.com +https
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29796
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;help.netflix.com.              IN      A

;; ANSWER SECTION:
help.netflix.com.       32      IN      CNAME   help.dradis.netflix.com.
help.dradis.netflix.com. 60     IN      CNAME   help.us-east-2.internal.dradis.netflix.com.
help.us-east-2.internal.dradis.netflix.com. 60 IN CNAME apiproxy-helpcenter-nlb-6cc037a5a8a90429.elb.us-east-2.amazonaws .com.
apiproxy-helpcenter-nlb-6cc037a5a8a90429.elb.us-east-2.amazonaws.com. 60 IN A 3.136.253.118
apiproxy-helpcenter-nlb-6cc037a5a8a90429.elb.us-east-2.amazonaws.com. 60 IN A 52.14.201.162
apiproxy-helpcenter-nlb-6cc037a5a8a90429.elb.us-east-2.amazonaws.com. 60 IN A 3.133.57.11

;; Query time: 35 msec
;; SERVER: 1.1.1.1#443(1.1.1.1) (HTTPS)
;; WHEN: Wed Nov 27 17:05:21 EST 2024
;; MSG SIZE  rcvd: 236

When I temporarily switch my browser to use DoH, Netflix sites start working again.

Incidentally the Netflix app on my phone is not able to connect to the Chromecast for streaming as of yesterday.  Not sure if related.  I'm seeing a persistent error message when trying to cast that I'm unable to find information about online.  This was working the day before.

[OPNenthu]

Ok, I solved it.

Services->Unbound DNS->Advanced->Strict QNAME Minimisation (uncheck)

Disabling that makes everything with Netflix work again, including the Chromecast.

Code: [Select]

$ dig help.netflix.com

; <<>> DiG 9.18.28-1~deb12u2-Debian <<>> help.netflix.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64904
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;help.netflix.com.              IN      A

;; ANSWER SECTION:
help.netflix.com.       300     IN      CNAME   help.dradis.netflix.com.
help.dradis.netflix.com. 60     IN      CNAME   help.us-east-1.internal.dradis.netflix.com.
help.us-east-1.internal.dradis.netflix.com. 60 IN CNAME apiproxy-helpcenter-nlb-8f45ed8b6aa9cee1.elb.us-east-1.amazonaws.com.
apiproxy-helpcenter-nlb-8f45ed8b6aa9cee1.elb.us-east-1.amazonaws.com. 60 IN A 3.231.234.168
apiproxy-helpcenter-nlb-8f45ed8b6aa9cee1.elb.us-east-1.amazonaws.com. 60 IN A 52.71.159.247
apiproxy-helpcenter-nlb-8f45ed8b6aa9cee1.elb.us-east-1.amazonaws.com. 60 IN A 3.222.220.127

;; Query time: 79 msec
;; SERVER: 192.168.40.1#53(192.168.40.1) (UDP)
;; WHEN: Wed Nov 27 18:12:00 EST 2024
;; MSG SIZE  rcvd: 236

Always a sad day having to disable a global pro-privacy option that had been working previously.