Hy everyone,
I have a PiHole instance running on my home server, and I changed my router (Fritz box) DNS in order to use my PiHole. Everything runs great.
I was wondering if I can put another DNS provider on my “alternative DNS server” in my router, in order to have a fallback alternative in case my server is down, or if I should avoid it.
I’m asking this because I don’t know if the request will be handled in parallel between the two DNS provider (that would make my PiHole useless) or not.
Thank you.
AFAIK the FritzBox switchs mainly to the faster DNS Server. I tried to use Quad9 with cloudfare as the second DNS server, most of the time cloudfare was the used since it was a bit faster.
When you specify more than one DNS server for network clients, the order in which these servers are used is not random. The following sequence is observed:
Primary DNS Server: Clients will first attempt to use the primary DNS server specified in their network settings. This server is often considered the default.
Secondary DNS Server: If the primary DNS server is unavailable or unable to resolve a query, clients will then attempt to use the secondary DNS server. This server acts as a backup.
So in OPs case his Pihole will always be used if it’s available, and only when it’s not will the secondary be used.
Except that, as I’ve already mentioned, I have two piholes, and sometimes both will be receiving requests. Based on your description, the second would never receive requests as long as the first is online. Perhaps this is router dependent, but it’s what I’ve observed.
A number of problems in DNS operations today are attributable to poor choices of secondary servers for DNS zones
That RFC is about DNS servers in the context of DNS zones in domain names. Not for a DNS client running DNS queries like an operating system. And the RFC is very clear about this:
The distinction between primary and secondary servers is relevant only to the servers for the zone concerned, to the rest of the DNS there are simply multiple servers.
For your Windows, Linux whatever machine “there are simply multiple DNS servers”.
Which defines/influences how resolvers behave with multiple DNS servers.
It doesn’t. As I said in another comment “most operating systems will just load balance or opportunistically pick between the two”, and there’s the relevant part from the RFC:
All are treated equally at first instance, even by the parent server that delegates the zone. Resolvers often measure the performance of the various servers, choose the “best”, for some definition of best, and prefer that one for most queries.
90% of network traffic uses the primary, but some things like to use both or exclusively the secomd one on random days.
I use Gravity-Sync to keep the settings/lists between them identical. (lots of local dns records for local self-hosted stuff, and each device has a static ip + dns record to identify it easily in logs)
I’ve set my secondary DNS to cloudflare, and my pihole still blocked ads for me. I assumed the secondary DNS server is used only if the primary can’t be pinged. But i haven’t actually looked into it.
Putting Cloudflare as my secondary would allow some requests to get through and then often the device whose requests went to Cloudflare would continue using Cloudflare for a while.
The best solution I found was to run a second Pihole and use it as the secondary.
You can use something like orbital sync to keep them syncronized
Pretty much. Not sure how the router determines which DNS to use, but mine seems to latch onto whichever one serves up results the fastest, which would inevitably be cloudflare direct after the pihole returns enough blocks.
So I use a Raspberry Pi Zero W as a dedicated pihole, and my Pi 4 seedbox acts as its own pihole and as a redundant backup. Then use gravity-sync from the Zero to the 4 to mirror the settings.
Another cool trick is using tailscale to ensure your portable devices always can access your Pihole(s) from anywhere and then setting those server’s tailscale addresses as your DNS servers in tailscale.
This way you can always use your DNS from anywhere, even on cell data or on public networks
I keep a third instance of Pihole running on a VPS and use it as the first DNS server in tailscale so it will resolve a bit faster than my local DNS servers when I’m away from home
Huh, I’ll definitely look into that. Both times I tried to route external pihole access, somehow other mystery services found it and it slowed to a crawl from getting absolutely pounded by requests not from me. Thanks for that tip!
Afaik there is no primary and secondary, you cant tell which one to use.
Its best to have 2 piholes, but having 2nd DNS set to nextdns or something like that should be fine if you cant run 2 instances, probably not the best setup tho
I’m not sure if this is a response to my comment but the article I linked isn’t about setting a secondary dns, the fritz!box has a function that allows it to temporarily change the dns (usually to 8.8.8.8) if the specified dns isn’t working. It is separate from the “normal” dns settings.
I tried that, devices just request to alternate dns when they get nothing from pihole. I use adgh, and ig there is a setting where you can set the answer to blocked stuff, like 0.0.0.0, empty…etc. if you set thay to 0.0.0.0, devices won’t query 2nd dns (i hope) when adgh is up. But it is best to have a 2nd pihole/adgh, i have one on my proxmox and another on a pi, synced with adgh sync
Edit: if you don’t have another pi, use nextdns
You should put your pihole server in the dns server in the network settings. My mobile devices didn’t use my pihole server until I changed the dns server configured there… (I am using a FritzBox as well)
mary DNS Server: Clients will first attempt to use the primary DNS server specified in their network settings. This ser
What’s the point tho? If your PiHole fails you need to know otherwise you could be risking days / months of web surfing in the fallback DNS server without even noticing it.
As for a reply, there’s no RFC that specifies that a specific order is applied to DNS servers. So in short, you can’t have a fallback that is reliable and most operating systems will just load balance or opportunistically pick between the two.
Thank you, this is what I was worrying about.
As for the “why”, even if my server is quite stable, a shutdown may be necessary and sometimes slowdowns with pi-hole happened. Some redundancy would have been better.
Well, I’m not sure you read the other comments but there is confirmation that for clients there isn’t an order for DNS servers from RFC2182:
The distinction between primary and secondary servers is relevant only to the servers for the zone concerned, to the rest of the DNS there are simply multiple servers.
All are treated equally at first instance, even by the parent server that delegates the zone. Resolvers often measure the performance of the various servers, choose the “best”, for some definition of best, and prefer that one for most queries.
The issue is that according to the spec the two DNS servers provided by DHCP are equivalent. While most clients favor the first one as the default, that’s not universally the case and when and how it switches to the secondary can vary by client (and effectively appear random). So you won’t be able to know for sure which client uses your DNS, especially after your DNS server was unreachable for a while for whatever reason. Personally I’ve “just” gotten a second Pi to run redundant copies of PiHole, but only having a single DNS server is usually fine as well.
I run multiple pinholes using keepalived. Then I only use one DNS in my DHCP server. Second pihole will seemlessly take over if the first one goes down whilst using the original DNS address.
Work quite well. I had to learn the hard way that only using a single pihole was just asking for my partner to be mad when it didn’t work / when I was doing server maintenance. Now I have multiple and they can all seemlessly take over if any my server nodes are down
Keepalived is the way. Gravity sync keeps everything in line. Works like a charm. I migrated yesterday from wifi to wired and cannot be happier.
As a bonus did not need to reconfigure pivpn.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
AFAIK the FritzBox switchs mainly to the faster DNS Server. I tried to use Quad9 with cloudfare as the second DNS server, most of the time cloudfare was the used since it was a bit faster.
When you specify more than one DNS server for network clients, the order in which these servers are used is not random. The following sequence is observed:
Primary DNS Server: Clients will first attempt to use the primary DNS server specified in their network settings. This server is often considered the default.
Secondary DNS Server: If the primary DNS server is unavailable or unable to resolve a query, clients will then attempt to use the secondary DNS server. This server acts as a backup.
So in OPs case his Pihole will always be used if it’s available, and only when it’s not will the secondary be used.
Except that, as I’ve already mentioned, I have two piholes, and sometimes both will be receiving requests. Based on your description, the second would never receive requests as long as the first is online. Perhaps this is router dependent, but it’s what I’ve observed.
There’s no RFC that specifies that a specific order is applied to DNS servers.
RFC 2182 details the operation and functionality of secondary DNS servers. Which defines/influences how resolvers behave with multiple DNS servers.
That RFC is about DNS servers in the context of DNS zones in domain names. Not for a DNS client running DNS queries like an operating system. And the RFC is very clear about this:
For your Windows, Linux whatever machine “there are simply multiple DNS servers”.
It doesn’t. As I said in another comment “most operating systems will just load balance or opportunistically pick between the two”, and there’s the relevant part from the RFC:
When it comes to a “secondary”DNS… there is nothing like a primary and secondary DNS server. These indications are quite misleading but many systems adopted it this way. Pihole only list the DNS servers as primary and secondary, because this is what the providers write on their pages. The bad phrasing is supported especially by how Windows handles it.
Most operating systems implement DNS servers as alternatives, not as fallbacks, i.e. they will query any of both servers from time to time, so it is quite likely that you will loose your Pi-hole filtering capabilities (at least partially) [if you specify a secondary DNS server on your network].
The ONLY DNS server you should have set on your network is a/the PiHole(s).
What you stated is generally a Windows only feature. Other OSes don’t adhere to that. Drives me crazy on Windows Servers too.
I setup a second pihole for redundancy.
90% of network traffic uses the primary, but some things like to use both or exclusively the secomd one on random days.
I use Gravity-Sync to keep the settings/lists between them identical. (lots of local dns records for local self-hosted stuff, and each device has a static ip + dns record to identify it easily in logs)
I’ve set my secondary DNS to cloudflare, and my pihole still blocked ads for me. I assumed the secondary DNS server is used only if the primary can’t be pinged. But i haven’t actually looked into it.
I have two piholes, and sometimes both will receive requests at the same time, if there’s a lot of traffic.
Yeah this is what I do.
Putting Cloudflare as my secondary would allow some requests to get through and then often the device whose requests went to Cloudflare would continue using Cloudflare for a while.
The best solution I found was to run a second Pihole and use it as the secondary.
You can use something like orbital sync to keep them syncronized
Pretty much. Not sure how the router determines which DNS to use, but mine seems to latch onto whichever one serves up results the fastest, which would inevitably be cloudflare direct after the pihole returns enough blocks.
So I use a Raspberry Pi Zero W as a dedicated pihole, and my Pi 4 seedbox acts as its own pihole and as a redundant backup. Then use gravity-sync from the Zero to the 4 to mirror the settings.
Another cool trick is using tailscale to ensure your portable devices always can access your Pihole(s) from anywhere and then setting those server’s tailscale addresses as your DNS servers in tailscale.
This way you can always use your DNS from anywhere, even on cell data or on public networks
I keep a third instance of Pihole running on a VPS and use it as the first DNS server in tailscale so it will resolve a bit faster than my local DNS servers when I’m away from home
Huh, I’ll definitely look into that. Both times I tried to route external pihole access, somehow other mystery services found it and it slowed to a crawl from getting absolutely pounded by requests not from me. Thanks for that tip!
Afaik there is no primary and secondary, you cant tell which one to use. Its best to have 2 piholes, but having 2nd DNS set to nextdns or something like that should be fine if you cant run 2 instances, probably not the best setup tho
When it comes to a “secondary”DNS… there is nothing like a primary and secondary DNS server. These indications are quite misleading but many systems adopted it this way. Pihole only list the DNS servers as primary and secondary, because this is what the providers write on their pages. The bad phrasing is supported especially by how Windows handles it.
Most operating systems implement DNS servers as alternatives, not as fallbacks, i.e. they will query any of both servers from time to time, so it is quite likely that you will loose your Pi-hole filtering capabilities (at least partially) [if you specify a secondary DNS server on your network].
The ONLY DNS server you should have set on your network is a/the PiHole(s).
Thanks for the clarification. I’ll be updating my settings.
I would avoid it, as it may use the alternate instead of the pihole at anytime. If you want redundancy, it’s best to have a second pihole.
https://fritzhelp.avm.de/help/en/FRITZ-Box-7530-AX-avme/avme/021/hilfe_internet_public_dns I found this guide for the fritz!box to set up a fallback dns, I think it should be on by default as it is on mine but I would read the article just to make sure
uh! this is interesting! I’m gonna look into this. Thanks!
When it comes to a “secondary”DNS… there is nothing like a primary and secondary DNS server. These indications are quite misleading but many systems adopted it this way. Pihole only list the DNS servers as primary and secondary, because this is what the providers write on their pages. The bad phrasing is supported especially by how Windows handles it.
Most operating systems implement DNS servers as alternatives, not as fallbacks, i.e. they will query any of both servers from time to time, so it is quite likely that you will loose your Pi-hole filtering capabilities (at least partially) [if you specify a secondary DNS server on your network].
The ONLY DNS server you should have set on your network is a/the PiHole(s).
I’m not sure if this is a response to my comment but the article I linked isn’t about setting a secondary dns, the fritz!box has a function that allows it to temporarily change the dns (usually to 8.8.8.8) if the specified dns isn’t working. It is separate from the “normal” dns settings.
Not sure about that as I never used/seen a Fritzbox, but I stand by “ The ONLY DNS server you should have set on your network is a/the PiHole(s).”
I tried that, devices just request to alternate dns when they get nothing from pihole. I use adgh, and ig there is a setting where you can set the answer to blocked stuff, like 0.0.0.0, empty…etc. if you set thay to 0.0.0.0, devices won’t query 2nd dns (i hope) when adgh is up. But it is best to have a 2nd pihole/adgh, i have one on my proxmox and another on a pi, synced with adgh sync Edit: if you don’t have another pi, use nextdns
You should put your pihole server in the dns server in the network settings. My mobile devices didn’t use my pihole server until I changed the dns server configured there… (I am using a FritzBox as well)
What’s the point tho? If your PiHole fails you need to know otherwise you could be risking days / months of web surfing in the fallback DNS server without even noticing it.
As for a reply, there’s no RFC that specifies that a specific order is applied to DNS servers. So in short, you can’t have a fallback that is reliable and most operating systems will just load balance or opportunistically pick between the two.
Thank you, this is what I was worrying about. As for the “why”, even if my server is quite stable, a shutdown may be necessary and sometimes slowdowns with pi-hole happened. Some redundancy would have been better.
Well, I’m not sure you read the other comments but there is confirmation that for clients there isn’t an order for DNS servers from RFC2182:
Setup two PiHoles
The issue is that according to the spec the two DNS servers provided by DHCP are equivalent. While most clients favor the first one as the default, that’s not universally the case and when and how it switches to the secondary can vary by client (and effectively appear random). So you won’t be able to know for sure which client uses your DNS, especially after your DNS server was unreachable for a while for whatever reason. Personally I’ve “just” gotten a second Pi to run redundant copies of PiHole, but only having a single DNS server is usually fine as well.
This answered my question. Thank you. I guess I will sacrifice redundancy
Or set up a second pi-hole.
I run multiple pinholes using keepalived. Then I only use one DNS in my DHCP server. Second pihole will seemlessly take over if the first one goes down whilst using the original DNS address.
Work quite well. I had to learn the hard way that only using a single pihole was just asking for my partner to be mad when it didn’t work / when I was doing server maintenance. Now I have multiple and they can all seemlessly take over if any my server nodes are down
How do you manage automatically transferring the ip of the main rpi to the backup rpi when the first disappears?
Keepalived
clone the Mac address
Don’t you then run into MAC conflicts?
How do you keep both on the network?
I’m just spit balling here: backup pi pings munute-ly main pi. if main pi is down 2 pings, it resets Mac and reboots network interface.
oh. fuck.
Arduino? lol
Keepalived is the way. Gravity sync keeps everything in line. Works like a charm. I migrated yesterday from wifi to wired and cannot be happier. As a bonus did not need to reconfigure pivpn.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
[Thread #433 for this sub, first seen 17th Jan 2024, 09:35] [FAQ] [Full list] [Contact] [Source code]