Random "Server not found" issues with DoT enabled on RT-AX86U Pro

[wiremonkey]

I've followed all ASUS and DNS-provider instructions to enable DoT for either (and both) Quad9 and Cloudflare on the router and in all cases I've suddenly started getting random "Server not found" errors on all connected devices in daily use. As soon as I disable DoT, this issue disappears.

Has anyone else seen such a thing? The worst part is DoT worked perfectly fine on this router with no such issues for many months (and an RT-AC86U before it). It seems like it started around 3-4 weeks ago and nothing had been changed.

 

[dave14305]

Similar thread recently. Could be the providers.

DNS-over-TLS taking too long RT-AC86U

Many times during the day DNS will take too long, and I get a Server Not Found error in the browser, even for sites I'm accessing frequently. It's not just the browser, I'll get it in other apps like git-bash occasionally. I never had this problem before switching to DNS-over-TLS. Attached is...

www.snbforums.com

 

[bbunge]

I am using Cloudflare Security with no issues.
Set your WAN DNS Setting to 1.1.1.2 and 1.0.0.2
Enable DNS Rebind protection - No
Enable DNSSEC support - No
DNS Privacy Protocol - DNS over TLS (DOT)
DNS-over-TLS Server List
IP Address - 1.1.1.2 and 1.0.0.2
TLS Hostname - security.cloudflare-dns.com
Note: the above is a manual entry. Use the Cloudflare presets if you want.
Use only one DNS upstream resolver (Quad9 or Cloudflare or ... but only one)!
If you have IPV6 alternate the IPV4 and IPV6 addresses.

Some upstream resolvers do not work well with DoT. Recently I've had problems with ControlD DoT not working at all and Quad9 is iffy. Cloudflare works very well for me.

 

[Tech9]

but only one

I always use 2x upstream DNS providers. Cloudflare and Google currently.

 

[wiremonkey]

Similar thread recently. Could be the providers.

DNS-over-TLS taking too long RT-AC86U

Many times during the day DNS will take too long, and I get a Server Not Found error in the browser, even for sites I'm accessing frequently. It's not just the browser, I'll get it in other apps like git-bash occasionally. I never had this problem before switching to DNS-over-TLS. Attached is...

www.snbforums.com

One difference in my case is my browser nearly instantly replies with "Server not found". Reports from that thread seem to discuss longer timeouts (10 seconds?) if I'm reading it right. That near-instant error makes me skeptical that the request is really even getting out of my router. Also, the issue suddenly started happening with DoT configured for either Quad9 or Cloudflare. It seemed exceedingly unlikely to me that two independent providers would suddenly have the exact same issue.

 

[wiremonkey]

I am using Cloudflare Security with no issues.
Set your WAN DNS Setting to 1.1.1.2 and 1.0.0.2
Enable DNS Rebind protection - No
Enable DNSSEC support - No
DNS Privacy Protocol - DNS over TLS (DOT)
DNS-over-TLS Server List
IP Address - 1.1.1.2 and 1.0.0.2
TLS Hostname - security.cloudflare-dns.com
Note: the above is a manual entry. Use the Cloudflare presets if you want.
Use only one DNS upstream resolver (Quad9 or Cloudflare or ... but only one)!
If you have IPV6 alternate the IPV4 and IPV6 addresses.

Some upstream resolvers do not work well with DoT. Recently I've had problems with ControlD DoT not working at all and Quad9 is iffy. Cloudflare works very well for me.

This was my exact configuration for about a year and worked well up until this odd issue started presenting itself. I've re-enabled DoT again and will see how long it takes for the issue to return.

 

[dave14305]

One difference in my case is my browser nearly instantly replies with "Server not found". Reports from that thread seem to discuss longer timeouts (10 seconds?) if I'm reading it right. That near-instant error makes me skeptical that the request is really even getting out of my router. Also, the issue suddenly started happening with DoT configured for either Quad9 or Cloudflare. It seemed exceedingly unlikely to me that two independent providers would suddenly have the exact same issue.

No, you're not reading the other thread correctly, but no matter. Post your DNS settings from the router WAN page. When the browser fails, test an nslookup of the same domain from the device's command line (assuming it's a laptop or desktop). Do those also fail?