Fallback to other DNS servers

[mrx23dot]

mail.google.com failed to resolve (NX DNS error), I had to restart dnscrypt-proxy daemon manually to get it working again. After it worked without problem.

No idea what DNS server it auto selected, but shouldn't it try at least 3 random servers before returning failure?
Is it already implemented?

I have selected:

    dnscrypt_servers = true
    require_dnssec = true
    odoh_servers = true
    require_nolog = true
#no server_names

[jedisct1]

A "this domain doesn't exist" response is a perfectly valid response, so the proxy accepts and caches it.

This is different from a server error, where retries will happen.

The real issue here is why a resolver returned a "this domain doesn't exist" response for mail.google.com. What server was it?

[mrx23dot]

ping mail.google.com failed to give IP with dnscrypt-proxy, after I restarted it it worked again.

[mrx23dot]

No idea what it auto selected, but shouldn't matter, can happen in future with any server,
as I remember my browser said NX DNS error, so if it used cached IP then it wouldn't show DNS error,
so my bet is that selected DNS server failed to respond and further ones weren't asked, is that possible?

Good point about the cache, I will disable that, it's more robust if cached on user's device.

[mrx23dot]

Happened again, now ping seems to be working

[mrx23dot]

Dec 25 11:33:20 me dnscrypt-proxy[58722]: [2022-12-25 11:33:20] [NOTICE] -   293ms jp.tiarap.org
Dec 25 11:33:20 me dnscrypt-proxy[58722]: [2022-12-25 11:33:20] [NOTICE] -   298ms publicarray-au-doh
Dec 25 11:33:20 me dnscrypt-proxy[58722]: [2022-12-25 11:33:20] [NOTICE] -   303ms publicarray-au2-doh
Dec 25 11:33:20 me dnscrypt-proxy[58722]: [2022-12-25 11:33:20] [NOTICE] -   306ms userspace-australia
Dec 25 11:33:20 me dnscrypt-proxy[58722]: [2022-12-25 11:33:20] [NOTICE] -   314ms quad101
Dec 25 11:33:20 me dnscrypt-proxy[58722]: [2022-12-25 11:33:20] [NOTICE] -   346ms deffer-dns.au
Dec 25 11:33:20 me dnscrypt-proxy[58722]: [2022-12-25 11:33:20] [NOTICE] -   351ms starrydns
Dec 25 11:33:20 me dnscrypt-proxy[58722]: [2022-12-25 11:33:20] [NOTICE] -  1344ms ahadns-doh-la
Dec 25 11:33:20 me dnscrypt-proxy[58722]: [2022-12-25 11:33:20] [NOTICE] -  1854ms ahadns-doh-nl
Dec 25 11:33:20 me dnscrypt-proxy[58722]: [2022-12-25 11:33:20] [NOTICE] Server with the lowest initial latency: dct-at1 (rtt: 15ms)

[mrx23dot]

Now it started working again, by it's own

Pinging youtube.com [142.250.180.238] with 32 bytes of data:
Reply from 142.250.180.238: bytes=32 time=9ms TTL=116
Reply from 142.250.180.238: bytes=32 time=9ms TTL=116

Ping statistics for 142.250.180.238:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 9ms, Maximum = 9ms, Average = 9ms

no update on status output.
IP changed, both IPs were pinging, but old IP didn't allow secure domain resolving.

[mrx23dot]

I turned off caching and restarted it, but I still see this issue from time to time, something is wrong with the concept.
DNS_PROBE_FINISHED_NXDOMAIN

[mrx23dot]

I have noticed similar issue with encrypted DNS built into firefox, even with cloudfare DNS
so I think this is not reliable technology, and redundancy is a must, so issuing the same request to min 2 different DNS servers would help a lot.

But luckily DNSCrypt is one common place we could solve this, and it would seem transparent.
No one else noticed this?

[lifenjoiner]

jedisct1 has explained:

A "this domain doesn't exist" response is a perfectly valid response, so the proxy accepts and caches it.

(valid by the RFC standard, rather than somebody's expectation.)
So, it won't try (fallback to) any new servers.

I think, the work for you is to filter the "unreliable" upstream servers:
Turn on the query_log file. When those fatal false answers appear, find out which server is it from, and then block the server by disabled_server_names. Restart dnscrypt-proxy.
Repeat the procedure until the answers quality is good enough.

[mrx23dot]

Actually it's not that simple, as I mentioned above I was looking for gmail.com (highly impossible to be down),
they changed IPs, which wasn't propagated to the DNS server yet (giving back to old IP), thus it returned RFC invalid.
(I specifically disabled caching in dnscrypt)

The DNS server worked correctly before, and it was the list for a good reason.

Same thing I noticed when not using dnscrypt, but encrypted DNS + cloudfare DNS server in firefox, some times it just fails to give back anything. I had problems at 3 different locations/PC/DNS servers/OSs/software, the only thing in common was that I enabled encrypted DNS.

Does encrypted DNS work perfectly for everyone else, all the time for years?

[lifenjoiner]

1. That is really different from your previous examples of "famous" domains: gmail and youtube.

2. they changed IPs, which wasn't propagated to the DNS server yet (giving back to old IP), thus it returned RFC invalid.

   It is not likely to be true. NX DNS, should be NXDOMAIN, which is nothing but Non-eXistent Internet or Intranet domain name.

3. I think the standard for NXDOMAIN to be a valid response means we choose to trust the DNS. If the DNS is not reliable, make it reliable. To be reliable is the responsibility of a DNS.

4. The facts are there are DNS not reliable enough, there could be gaps between new domains are online and be available, and of course there are domain names that are really non-existent.

5. NX DNS covers the above 3 cases as I call tell, so, how can you tell the difference? If not, retry would not be a perfect solution. Real non-existent ones will always timeout. Will you wait that long?

6. I use some other tool has BlockNegativeResponse option, and found the disadvantage above.

7. I use 2 levels of DNS proxies. For example, one of the strategies is using region based rules, because the available servers are overseas to me; and they are not always fast, I adopt parallel querying; plus auto-updated blocking rules (Better? Maybe... just feel better!). All depend on your network.

[mrx23dot]

Parallel querying sounds promising, how did you set it up? I didn't find it in man.
It might mess with ad blocking, but seeing a website is better than nothing.

[lifenjoiner]

That is dnsforwader fork maintained by myself, plain DNS server.