tailscale / tailscale/tailscale

Tailscale DNS hangs on upstream `SERVFAIL` (AAAA query)

Open
#9,384 1 comment 0 reactions 0 assignees View on GitHub
bug dns needs-triage
Dominant language
Go
Stars
36.5k
Forks
3.2k
Avg merge
1d 23h
Merged PRs (30d)
132

Description

### What is the issue?

I think am running into an issue similar to #4722 , although in my case it's an AAAA query that is failing.

I have a single upstream AdguardHome DNS configured in Tailscale, that in turn runs on a Tailscale node. For some specific domain, this DNS returns `SERVFAIL` to the AAAA query and this causes `100.100.100.100` to hang.

Note: I have redacted the domain to `target-domain.tld` since the query resolves fine on a different DNS (hence likely not useful to the bug report, I can share if needed).

```
dig @100.100.100.100 target-domain.tld AAAA
;; communications error to 100.100.100.100#53: timed out
;; communications error to 100.100.100.100#53: timed out
;; communications error to 100.100.100.100#53: timed out

; <<>> DiG 9.18.17 <<>> @100.100.100.100 target-domain.tld AAAA
; (1 server found)
;; global options: +cmd
;; no servers could be reached
```

While if I query directly the upstream:

```
dig @100.71.177.5 target-domain.tld AAAA

; <<>> DiG 9.18.17 <<>> @100.71.177.5 target-domain.tld AAAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 9090
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;target-domain.tld. IN AAAA

;; Query time: 945 msec
;; SERVER: 100.71.177.5#53(100.71.177.5) (UDP)
;; WHEN: Wed Sep 13 16:58:27 CEST 2023
;; MSG SIZE rcvd: 43
```

### Steps to reproduce

- configure the Tailscale DNS with an upstream DNS inside Tailscale (probably not relevant)
- bump into a domain for which the AAAA query returns `SERVFAIL` (not sure how one would "force" this circumstance)
- query `100.100.100.100` with an AAAA query for the same domain.

### Are there any recent changes that introduced the issue?

_No response_

### OS

Linux

### OS version

Fedora 38

### Tailscale version

1.48.1

### Other software

AdguardHome as upstream DNS.

### Bug report

BUG-ace76e53b7d16f6d50942ee8315b28fc903dfd27f4df086c47436927fce8dfae-20230913150949Z-3ffbcc8723676a13

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.