<html><head></head><body>Hello,<br><br>We are using dnsmasq with the all-servers option enabled in order to prevent issues with DNS resolution when a single resolver is not working properly.<br>We have noticed that sometimes when a single resolver is unreachable we still have issues with DNS resolution. It appears this is related to dnssec-query[DS] performed by dnsmasq:<br><br>For example the following query gives us a timeout:<br><br>```<br>dig nu.nl DS @127.0.0.1<br><br>; <<>> DiG 9.16.48-Debian <<>> nu.nl DS @127.0.0.1<br>;; global options: +cmd<br>;; connection timed out; no servers could be reached<br>```<br><br>In the dnsmasq logs, we see:<br><br>```<br>Aug 14 11:11:18 srv01 dnsmasq[1808159]: query[DS] nu.nl from 127.0.0.1<br>Aug 14 11:11:18 srv01 dnsmasq[1808159]: forwarded nu.nl to 1.1.1.1<br>Aug 14 11:11:18 srv01 dnsmasq[1808159]: forwarded nu.nl to 1.0.0.1<br>Aug 14 11:11:18 srv01 dnsmasq[1808159]: forwarded nu.nl to 8.8.8.8<br>Aug 14 11:11:18 srv01 dnsmasq[1808159]: forwarded nu.nl to 8.8.4.4<br>Aug 14 11:11:18 srv01 dnsmasq[1808159]: forwarded nu.nl to 2606:4700:4700::1111<br>Aug 14 11:11:18 srv01 dnsmasq[1808159]: forwarded nu.nl to 2606:4700:4700::1001<br>Aug 14 11:11:18 srv01 dnsmasq[1808159]: forwarded nu.nl to 2001:4860:4860::8888<br>Aug 14 11:11:18 srv01 dnsmasq[1808159]: forwarded nu.nl to 2001:4860:4860::8844<br>Aug 14 11:11:18 srv01 dnsmasq[1808159]: dnssec-query[DS] nl to 2001:4860:4860::8844<br>Aug 14 11:11:23 srv01 dnsmasq[1808159]: query[DS] nu.nl from 127.0.0.1<br>Aug 14 11:11:23 srv01 dnsmasq[1808159]: dnssec retry to 2001:4860:4860::8844<br>Aug 14 11:11:28 srv01 dnsmasq[1808159]: query[DS] nu.nl from 127.0.0.1<br>Aug 14 11:11:28 srv01 dnsmasq[1808159]: dnssec retry to 2001:4860:4860::8844<br>```<br><br>And in a tcpdump we see the following (I have replaced source IPs with a dummy):<br><br>```<br>11:11:18.223473 lo In IP 127.0.0.1.37864 > 127.0.0.1.53: 12671+ [1au] DS? nu.nl. (46)<br>11:11:18.223595 eth0 Out IP 1.2.3.4.53036 > 1.1.1.1.53: 49121+ [1au] DS? nu.nl. (46)<br>11:11:18.223618 eth0 Out IP 1.2.3.4.53036 > 1.0.0.1.53: 49121+ [1au] DS? nu.nl. (46)<br>11:11:18.223634 eth0 Out IP 1.2.3.4.53036 > 8.8.8.8.53: 49121+ [1au] DS? nu.nl. (46)<br>11:11:18.223650 eth0 Out IP 1.2.3.4.53036 > 8.8.4.4.53: 49121+ [1au] DS? nu.nl. (46)<br>11:11:18.223690 eth0 Out IP6 2001::100.49508 > 2606:4700:4700::1111.53: 49121+ [1au] DS? nu.nl. (46)<br>11:11:18.223710 eth0 Out IP6 2001::100.49508 > 2606:4700:4700::1001.53: 49121+ [1au] DS? nu.nl. (46)<br>11:11:18.223733 eth0 Out IP6 2001::100.49508 > 2001:4860:4860::8888.53: 49121+ [1au] DS? nu.nl. (46)<br>11:11:18.223749 eth0 Out IP6 2001::100.49508 > 2001:4860:4860::8844.53: 49121+ [1au] DS? nu.nl. (46)<br>11:11:18.225023 eth0 In IP 8.8.8.8.53 > 1.2.3.4.53036: 49121$ 0/4/1 (375)<br>11:11:18.225122 eth0 Out IP6 2001::100.49142 > 2001:4860:4860::8844.53: 4797+ [1au] DS? nl. (31)<br>11:11:18.226018 eth0 In IP6 2606:4700:4700::1001.53 > 2001::100.49508: 49121$ 0/4/1 (375)<br>11:11:18.226051 eth0 In IP 1.0.0.1.53 > 1.2.3.4.53036: 49121$ 0/4/1 (375)<br>11:11:18.226070 eth0 In IP6 2606:4700:4700::1111.53 > 2001::100.49508: 49121$ 0/4/1 (375)<br>11:11:18.226146 eth0 In IP 1.1.1.1.53 > 1.2.3.4.53036: 49121$ 0/4/1 (375)<br>11:11:18.228253 eth0 In IP 8.8.4.4.53 > 1.2.3.4.53036: 49121$ 0/4/1 (375)<br>11:11:18.228416 eth0 In IP6 2001:4860:4860::8844.53 > 2001::100.49508: 49121$ 0/4/1 (375)<br>11:11:23.221313 lo In IP 127.0.0.1.37864 > 127.0.0.1.53: 12671+ [1au] DS? nu.nl. (46)<br>11:11:23.221463 eth0 Out IP6 2001::100.49142 > 2001:4860:4860::8844.53: 4797+ [1au] DS? nl. (31)<br>11:11:28.221184 lo In IP 127.0.0.1.37864 > 127.0.0.1.53: 12671+ [1au] DS? nu.nl. (46)<br>11:11:28.221347 eth0 Out IP6 2001::100.49142 > 2001:4860:4860::8844.53: 4797+ [1au] DS? nl. (31)<br>```<br><br>Now, it appears that initially the query is sent out to all configured DNS servers. <br>After that, there is a response and dnsmasq will then attempt to perform a `DS? nl.` query. This query is however only sent out to a single server (2001:4860:4860::8844). A retry is sent out twice, both to the same IP.<br>Because this fails, our DNS lookup also gets a timeout.<br><br>We would like for this `DS? nl.` call caused by dnssec-query[DS] to also utilize all configured backend servers, so the query succeeds instead of fails like it does now.<br><br>This is our dnsmasq.conf:<br><br>```<br>all-servers<br>clear-on-reload<br>bind-interfaces<br>cache-size=1500<br>dnssec<br>interface=lo<br>max-cache-ttl=3600<br>neg-ttl=20<br>resolv-file=/etc/resolv.dnsmasq<br>log-queries<br>```<br><br>Can my desired behaviour be achieved?<br><br>Thank you!<br><div>Niels Hendriks<br></div></body></html>