DNS over tls when running two different servers

[DEC740airp414user]

I subscribe to nextdns and controld

I've been using controld as my only dns over tls server.   Well today their service was down for about an hour.     It had been a Long time since I enabled two servers.  Today  I enabled both services I subscribed too.

I then logged into the nextdns website, and every sec it said I was using their service then it kept going to red saying I was not


Can anyone explain how dns over tls works when you have two servers added?

[yourfriendarmando]

It's possible your client was using its own DNS services. Browsers tend to try using their own DNS these days out of the box.

[DEC740airp414user]

I still am just using one dns over TLS server.  but using quad 9 now.    this option called forward first.   is this new?    I am not seeing this in any documentation.    it seems like it would fix my issue if forwarding to quad 9 or similar stopped.   it would use standard unbound.. correct?

where do I define the server time out setting?

later edit.  my googlefu has been bad this morning.   I did find this that explains what it is https://forum.opnsense.org/index.php?topic=45521.0

[lmoore]

this option called forward first.  is this new?

No, its not new.

If I understand the behaviour for a "." zone, as per your configuration (domain field is bank), I expect this will result in DNS queries being forwarded to root servers in the event SERVFAIL is encountered - this may not be what you want.

I have configured Unbound to use the two DNS servers at Quad9 which offer Threat-blocking with DNSSEC and I do not have Forward first enabled.

An extract from an unbound.conf file which can be downloaded from Quad9.net where they will be the sole DNS provider;

https://docs.quad9.net/assets/conf/freebsd/forward.conf

Code Select Expand

forward-zone:
    name: "."
    forward-tls-upstream: yes        # Use DNS-over-TLS
    forward-first: no            # do NOT send direct

Here is the information on the Unbound site: https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#unbound-conf-forward-forward-first

In my environment, I've blocked all access to external DNS servers as best I can. Restricting TCP/UDP port 53 was easy, it's the DoHS which is the challenge.

These are the two forwarders I've configured for Quad9.

[DEC740airp414user]

I am only wanting a backup DNS method in case dns over TLS Fails

unbound recursive is fine

[nero355]

I am only wanting a backup DNS method in case dns over TLS Fails.

That's a tough topic when talking about DNS in general : You always needs some kind of CARP/VRRP to achieve the best results :)


But to get back to your original question that this topic started with a  bit :

I think what you have seen is this => https://www.rfc-editor.org/info/rfc7858/#section-3.4

To avoid excess TCP connections, each with a single query, clients SHOULD reuse a single TCP connection to the recursive resolver.

So when you added the new DoT Provider/Service it got picked instead of the old one and from that moment on your Unbound simply kept re-using that connection until it goes down for whatever reason I am guessing...

[lmoore]

I am only wanting a backup DNS method in case dns over TLS Fails

Refer to the note in OPNsense documentation found here: https://docs.opnsense.org/manual/unbound.html#dns-over-tls

It's possible that if DNS over TLS fails to Quad9 due to a problem at their end or somewhere in between, its quite probable queries using the traditional port 53 will also fail.

As a contingency in my configuration I have include the two Cloudflare DNS servers, which also provide threat-blocking over DNSSEC, but they are disabled. I've not experienced problems with Quad9 where I've had to use them.

In the event Quad9 becomes unusable, I would add Cloudflare DNS servers to my list of external trusted DNS servers and then enable them in Unbound's DNS over TLS settings, as well as disabling the Quad9 entries.