What's new
By:

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

My DoT configuration (eventually) blocks sites again

swejuggalo

swejuggalo

Senior Member
I had this on AX88U. Now it's back on BE88U. I'm using Cloudflare with DoT enabled.
I think I gave up on this the last time (on AX88U) and pretty much used ISP defaults eventually.

What's interesting is that it's very specific, like https://www.swedbank.se (all clients affected, homepage or phone apps), but I doubt it's the only one.

The quick fix is to simply restart "internet connection" in scMerlin. But if going by the history this would not last for many hours or with some luck some days.

Can the setup someone be bad/incompatible with my ISP or something?
What can I do to trial and error this behavior?

What can possibly be wrong here? It seems impossible that this part alone to be badly configured, right?
 

Attachments

  • Screenshot 2025-07-27 at 00.35.22.png
    Screenshot 2025-07-27 at 00.35.22.png
    132 KB · Views: 17
If you have Diversion installed and logging enabled, you should be able to find some hints about what happens. Try some of these commands:
Code: 
cd /opt/var/log
grep swedbank dnsmasq.log
grep SERVFAIL dnsmasq.log
opkg install bind-dig
dig www.swedbank.se @127.0.0.1
dig www.swedbank.se @127.0.1.1
 
Your setup is correct. Could also be Cloudflare anycast (they have had issues lately)

I use Cloudflare Security: 1.1.1.2 and 1.0.0.2 with TLS Hostname: security.cloudflare-dns.com
No issues here on Asus firmware or Merlin 3006.102.4 or 3006.102.5 beta 2.
Diversion using the StevenBlack master host list.
 
dave14305 said:
If you have Diversion installed and logging enabled, you should be able to find some hints about what happens. Try some of these commands:
Code: 
cd /opt/var/log
grep swedbank dnsmasq.log
grep SERVFAIL dnsmasq.log
opkg install bind-dig
dig www.swedbank.se @127.0.0.1
dig www.swedbank.se @127.0.1.1
Click to expand...
Many of these.

Jul 27 00:51:23 dnsmasq[22113]: reply error is SERVFAIL

Code: 
Jul 27 00:35:48 dnsmasq[15786]: forwarded swedbankab.d3.sc.omtrdc.net to 127.0.1.1Jul 27 00:35:48 dnsmasq[15786]: reply swedbankab.d3.sc.omtrdc.net is 63.140.62.172Jul 27 00:35:48 dnsmasq[15786]: reply swedbankab.d3.sc.omtrdc.net is 63.140.62.120Jul 27 00:35:48 dnsmasq[15786]: reply swedbankab.d3.sc.omtrdc.net is 63.140.62.210Jul 27 00:35:48 dnsmasq[15786]: reply swedbankab.d3.sc.omtrdc.net is 63.140.62.236Jul 27 00:35:48 dnsmasq[15786]: reply swedbankab.d3.sc.omtrdc.net is 63.140.62.139Jul 27 00:35:48 dnsmasq[15786]: reply swedbankab.d3.sc.omtrdc.net is 63.140.62.200Jul 27 00:48:58 dnsmasq[29259]: query[A] swedbankab.d3.sc.omtrdc.net from 192.168.50.87
Jul 27 00:48:58 dnsmasq[29259]: forwarded swedbankab.d3.sc.omtrdc.net to 127.0.1.1Jul 27 00:48:58 dnsmasq[29259]: reply swedbankab.d3.sc.omtrdc.net is 63.140.62.120Jul 27 00:48:58 dnsmasq[29259]: reply swedbankab.d3.sc.omtrdc.net is 63.140.62.210Jul 27 00:48:58 dnsmasq[29259]: reply swedbankab.d3.sc.omtrdc.net is 63.140.62.139Jul 27 00:48:58 dnsmasq[29259]: reply swedbankab.d3.sc.omtrdc.net is 63.140.62.200Jul 27 00:48:58 dnsmasq[29259]: reply swedbankab.d3.sc.omtrdc.net is 63.140.62.236Jul 27 00:48:58 dnsmasq[29259]: reply swedbankab.d3.sc.omtrdc.net is 63.140.62.172swejuggalo@RT-BE88U-F1B8:/tmp/mnt/disk/entware/var/log#

Package bind-dig (9.20.7-1) installed in root is up to date.

Code: 
; <<>> DiG 9.20.7 <<>> www.swedbank.se
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 7513
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 3b46b1e342fc164f0100000068856742cee3fe72a0181cba (good)
;; QUESTION SECTION:
;www.swedbank.se.               IN      A
;; ANSWER SECTION:
www.swedbank.se.        1241    IN      CNAME   cdn.adobeaemcloud.com.
cdn.adobeaemcloud.com.  41294   IN      CNAME   adobe-aem.map.fastly.net.
adobe-aem.map.fastly.net. 57    IN      A       199.232.175.10
;; Query time: 5 msec
;; SERVER: 62.127.97.32#53(62.127.97.32) (UDP)
;; WHEN: Sun Jul 27 01:39:46 CEST 2025
;; MSG SIZE  rcvd: 161

Maybe this is helpful.
 
swejuggalo said:
Maybe this is helpful.
Click to expand...
Please run the dig commands with the server specified like I wrote it. The first one will test dnsmasq+stubby, the second will test stubby alone.

Most likely, the servfail occurs when stubby loses contact with Cloudflare.
 
dave14305 said:
Please run the dig commands with the server specified like I wrote it. The first one will test dnsmasq+stubby, the second will test stubby alone.

Most likely, the servfail occurs when stubby loses contact with Cloudflare.
Click to expand...
Code: 
; <<>> DiG 9.20.7 <<>> www.swedbank.se @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40340
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.swedbank.se.               IN      A
;; ANSWER SECTION:
www.swedbank.se.        3503    IN      CNAME   cdn.adobeaemcloud.com.
cdn.adobeaemcloud.com.  86303   IN      CNAME   adobe-aem.map.fastly.net.
adobe-aem.map.fastly.net. 38    IN      A       151.101.67.10
adobe-aem.map.fastly.net. 38    IN      A       151.101.195.10
adobe-aem.map.fastly.net. 38    IN      A       151.101.3.10
adobe-aem.map.fastly.net. 38    IN      A       151.101.131.10
;; Query time: 22 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Sun Jul 27 01:50:53 CEST 2025
;; MSG SIZE  rcvd: 181
swejuggalo@RT-BE88U-F1B8:/tmp/mnt/disk/entware/var/log# dig www.swedbank.se @127.0.1.1
; <<>> DiG 9.20.7 <<>> www.swedbank.se @127.0.1.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52990
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.swedbank.se.               IN      A
;; ANSWER SECTION:
www.swedbank.se.        3597    IN      CNAME   cdn.adobeaemcloud.com.
cdn.adobeaemcloud.com.  86397   IN      CNAME   adobe-aem.map.fastly.net.
adobe-aem.map.fastly.net. 57    IN      A       151.101.3.10
adobe-aem.map.fastly.net. 57    IN      A       151.101.195.10
adobe-aem.map.fastly.net. 57    IN      A       151.101.67.10
adobe-aem.map.fastly.net. 57    IN      A       151.101.131.10
;; Query time: 11 msec
;; SERVER: 127.0.1.1#53(127.0.1.1) (UDP)
;; WHEN: Sun Jul 27 01:50:55 CEST 2025
;; MSG SIZE  rcvd: 181
 
dave14305 said:
It’s interesting that your logs show 3 different dnsmasq process IDs within a short window. Is dnsmasq restarting?
Code: 
cd /opt/var/log
grep cachesize dnsmasq.log
Click to expand...
Trying Cloudflare Safe for a while.
I'm assuming the replies would be totally different if in the error state.
Right now it works.

If it happens again I repost both dig commands?
 
swejuggalo said:
If it happens again I repost both dig commands?
Click to expand...
The grep commands are more useful. Note the time when the errors happen. It would also be useful to enable log-queries=extra in Diversion’s dnsmasq settings to better correlate queries and results.
 
dave14305 said:
It’s interesting that your logs show 3 different dnsmasq process IDs within a short window. Is dnsmasq restarting?
Code: 
cd /opt/var/log
grep cachesize dnsmasq.log
Click to expand...
Perhaps it is that I reverted temporary to my ISP DNS, plus DoT over Cloudflare. Changes here would trigger restart right?
 
dave14305 said:
It’s interesting that your logs show 3 different dnsmasq process IDs within a short window. Is dnsmasq restarting?
Code: 
cd /opt/var/log
grep cachesize dnsmasq.log
Click to expand...
But I'm definitely not doing stuff this often.
Code: 
Jul 26 12:43:05 dnsmasq[23781]: started, version 2.91 cachesize 1500
Jul 26 12:44:00 dnsmasq[28804]: started, version 2.91 cachesize 1500
Jul 26 12:44:51 dnsmasq[3058]: started, version 2.91 cachesize 1500
Jul 26 13:13:00 dnsmasq[29825]: started, version 2.91 cachesize 1500
Jul 26 13:38:42 dnsmasq[12547]: started, version 2.91 cachesize 1500
Jul 26 13:39:13 dnsmasq[24844]: started, version 2.91 cachesize 1500
Jul 26 13:41:39 dnsmasq[27187]: started, version 2.91 cachesize 1500
Jul 26 13:41:41 dnsmasq[27843]: started, version 2.91 cachesize 1500
Jul 26 18:39:45 dnsmasq[26340]: started, version 2.91 cachesize 1500
Jul 26 18:40:29 dnsmasq[11132]: started, version 2.91 cachesize 1500
Jul 26 18:40:36 dnsmasq[14008]: started, version 2.91 cachesize 1500
Jul 26 18:40:41 dnsmasq[15087]: started, version 2.91 cachesize 1500
Jul 26 18:42:51 dnsmasq[646]: started, version 2.91 cachesize 1500
Jul 26 18:44:25 dnsmasq[17121]: started, version 2.91 cachesize 1500
Jul 26 18:44:47 dnsmasq[21029]: started, version 2.91 cachesize 1500
Jul 26 18:45:08 dnsmasq[28837]: started, version 2.91 cachesize 1500
Jul 26 18:45:15 dnsmasq[31641]: started, version 2.91 cachesize 1500
Jul 26 18:48:29 dnsmasq[21689]: started, version 2.91 cachesize 1500
Jul 26 18:49:21 dnsmasq[28210]: started, version 2.91 cachesize 1500
Jul 26 18:50:13 dnsmasq[5071]: started, version 2.91 cachesize 1500
Jul 26 18:51:11 dnsmasq[12147]: started, version 2.91 cachesize 1500
Jul 26 18:56:38 dnsmasq[3936]: started, version 2.91 cachesize 1500
Jul 26 19:06:01 dnsmasq[12198]: started, version 2.91 cachesize 1500
Jul 26 19:06:20 dnsmasq[15693]: started, version 2.91 cachesize 1500
Jul 26 19:06:42 dnsmasq[24464]: started, version 2.91 cachesize 1500
Jul 26 19:06:49 dnsmasq[27242]: started, version 2.91 cachesize 1500
Jul 27 00:24:57 dnsmasq[12804]: started, version 2.91 cachesize 1500
Jul 27 00:25:01 dnsmasq[13948]: started, version 2.91 cachesize 1500
Jul 27 00:25:06 dnsmasq[15786]: started, version 2.91 cachesize 1500
Jul 27 00:42:51 dnsmasq[26764]: started, version 2.91 cachesize 1500
Jul 27 00:42:55 dnsmasq[28139]: started, version 2.91 cachesize 1500
Jul 27 00:42:59 dnsmasq[29259]: started, version 2.91 cachesize 1500
Jul 27 01:46:11 dnsmasq[23632]: started, version 2.91 cachesize 1500
Jul 27 01:46:15 dnsmasq[24901]: started, version 2.91 cachesize 1500
Jul 27 01:46:19 dnsmasq[25986]: started, version 2.91 cachesize 1500
 
dave14305 said:
It’s interesting that your logs show 3 different dnsmasq process IDs within a short window. Is dnsmasq restarting?
Code: 
cd /opt/var/log
grep cachesize dnsmasq.log
Click to expand...
Perhaps could scMerlin "Enable 'dnsmasq tainted' watchdog script" do some funny business?
Or perhaps I was doing this much stuff today that it would be normal. Split up stuff with VLAN and some other stuff, so I might be responsible to most of this.

I'll rerun that command a day when I done "nothing". If it still reboots when something is wrong.
 
You must log in or register to reply here.

Similar threads

consorts
Solved question from new to 2.5g wan port user
Replies
5
Views
210
consorts
consorts
F
Experiences in Roku vs. Ad-blocking
Replies
10
Views
3K
FourthandShort
F
J
Guest Network Pro on RT-AX88U Pro IoT VLAN Setup with TP-Link TL-SG1008 Unmanaged Switch
Replies
8
Views
1K
jerry6
jerry6
S
Asus RT-AX88U internet speed slows down after a few days
2
Replies
30
Views
3K
scandalous
S
A
WireGuard tunnel interferes with Tapo cloud app (blocks it)
Replies
13
Views
3K
ZebMcKayhan
Z
Similar threads
Thread starter Title Forum Replies Date
S Bell home internet users with Asus routers - does DoT work for you? Asuswrt-Merlin 25
outlaw78 DNS Director / DoT over TLS Asuswrt-Merlin 18
C DOT & IoT Devices Asuswrt-Merlin 3
L Suggestion: DNS Director, add optional compatibility with DOT Asuswrt-Merlin 2
copperhead VPN Director Configuration Help Asuswrt-Merlin 1
R Open VPN per client configuration router help Asuswrt-Merlin 15
Z Nord VPN and DNS Configuration options Asuswrt-Merlin 2
C DSL-AC68U - Configuration panels on GUI have disappeared Asuswrt-Merlin 1
G VPN director configuration for qBittorrent Asuswrt-Merlin 7

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 581 (members: 16, guests: 565)
Back
Top
✖