0

I am having issues on a client machine (Mac) accessing different sites, for instance reddit.com, after having used adguard/pihole in my local network on a raspberry pi.

To resolve the issue I thought it would be enough to set the DNS Server to something like 8.8.8.8 (google) on the wifi interface.

But when doing an nslookup -debug reddit.com I still get the following answer:

Server:     8.8.8.8
Address:    8.8.8.8#53

------------
    QUESTIONS:
    reddit.com, type = A, class = IN
    ANSWERS:
    AUTHORITY RECORDS:
    ->  reddit.com
    origin = cleanbrowsing.rpz.noc.org
    mail addr = accesspolicy.rpz.noc.org
    serial = 1
    refresh = 7200
    retry = 900
    expire = 1209600
    minimum = 86400
    ttl = 3600
    ADDITIONAL RECORDS:
------------
** server can't find reddit.com: NXDOMAIN

I have used my pi as pihole server or adguard home server previously on all my client machines in the network due to DHCP DNS configuration.

But now that I hardcode google DNS shouldn't I get the correct authoritative answer from Google DNS? For sure Google DNS knows reddit.com.

Edit:

What did I try already?

  • I flushed my Mac's DNS caches and just about every DNS cache on my networks machines
  • I connected to another network (personal hotspot) - I could resolve reddit.com using 8.8.8.8!

So it seems to have something to do with my network:

Here is my network:

  • Unifi Dream Machine SE as router with different networks
  • Each network on the UDM has 2 DNS servers set for DHCP: One pointing to a pihole, one to itself

When I connect to a network I automatically get the 2 DNS servers via DHCP config. The intention was to block malicious sites.

While working on that I deactivated the blocking but still couldn't access sites and had adblocking active :/ .

Then I hardcoded the upstream DNS of my machines to Google DNS and still wasn't able to resolve reddit.com.

Now I was puzzled and still am.

Fab1n
  • 111
  • 5
  • Google's DNS is 8.8.8.8 and 8.8.4.4 – gronostaj Dec 17 '22 at 08:52
  • I vaguely remember 4.4.4.4 and 4.4.2.2 were public DNS run by someone else – Journeyman Geek Dec 17 '22 at 10:34
  • You are right, I corrected the question to be 8.8.8.8. It really doesn't matter which DNS is set on my Mac. reddit.com and other domains simply cannot be resolved, due to the authority record I posted. – Fab1n Dec 17 '22 at 14:31
  • 1
    I don't know about Unifi, but some routers intercept & redirect DNS queries to the server the router's configured to use (e.g. in its DHCP configuration). I'd try configuring the UDM to use 8.8.8.8, then send test queries to both it and the pihole and see if it makes any difference. – Gordon Davisson Dec 17 '22 at 23:00
  • @GordonDavisson that is actually a really valuable tip. I’ll test that. – Fab1n Dec 18 '22 at 20:24

1 Answers1

1

Thanks to an answer here and also with the help of @Gordon Davisson's comment I found one solution to the problem in my networks Unifi UDM SE router: Under "Settings > Networks > [YourNetworkHere] > Advanced: Content Filtering" set the filtering mode to "None", otherwise cleanbrowsing.org will be used for DNS.

This would explain all the problems.

Fab1n
  • 111
  • 5