[Dnscrypt/Pihole] Sig failed on ns1.pi-hole.net,

[Kylvan-8]

Hello,

I have sig verification errors via my pihole however, when testing on some domains via the dnscrypt-proxy service it works.

Of course I am not able to resolve DNS requests from my local machines using the pi-hole.

I noticed that the sig on NS1.pi-hole.net did not return anything though when checking the sig with a dig.

Can you please help me ASAP?

I put screenshots to make it clearer.

Regards.

Sig failed

Sig OK

Pihole set up & errors

Set up

Errors

[lifenjoiner]

You'd better:

1. Show your config of dnscrypt-proxy, if there is any difference from the default one on this site;
2. Compare the dig tests on the same server, or the same test on different servers. At least, test ns1.pi-hole.net on dnscrypt-proxy.

[lifenjoiner]

The config shows you only use ODoH, which may not be very stable.

Maybe test:

dig -p 5392 ns1.pi-hole.net
dig -p 5392 +dnssec ns1.pi-hole.net
dig -p 5392 -t type65 +dnssec ns1.pi-hole.net

I'm not sure what Sig failed means. I don't use pi-hole. Maybe try:

dig -p 5392 txt versions.pi-hole.net

And check /var/log/dnscrypt-proxy.log to see if there is anything meaningful.

[Kylvan-8]

The problem is that i can't resolve any address anymore.

Results for dig

pi@Raspberry:/opt/dnscrypt-proxy $ dig -p 5392 ns1.pi-hole.net
dig -p 5392 +dnssec ns1.pi-hole.net
dig -p 5392 -t type65 +dnssec ns1.pi-hole.net
; <<>> DiG 9.11.5-P4-5.1+deb10u6-Raspbian <<>> -p 5392 ns1.pi-hole.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6250
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;ns1.pi-hole.net.               IN      A

;; ANSWER SECTION:
ns1.pi-hole.net.        3507    IN      A       205.251.193.151

;; Query time: 74 msec
;; SERVER: 127.0.0.1#5392(127.0.0.1)
;; WHEN: lun. mai 16 10:35:10 CEST 2022
;; MSG SIZE  rcvd: 60

pi@Raspberry:/opt/dnscrypt-proxy $ dig -p 5392 +dnssec ns1.pi-hole.net

; <<>> DiG 9.11.5-P4-5.1+deb10u6-Raspbian <<>> -p 5392 +dnssec ns1.pi-hole.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35313
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;ns1.pi-hole.net.               IN      A

;; ANSWER SECTION:
ns1.pi-hole.net.        3507    IN      A       205.251.193.151

;; Query time: 60 msec
;; SERVER: 127.0.0.1#5392(127.0.0.1)
;; WHEN: lun. mai 16 10:35:10 CEST 2022
;; MSG SIZE  rcvd: 60

pi@Raspberry:/opt/dnscrypt-proxy $ dig -p 5392 -t type65 +dnssec ns1.pi-hole.net

; <<>> DiG 9.11.5-P4-5.1+deb10u6-Raspbian <<>> -p 5392 -t type65 +dnssec ns1.pi-hole.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5172
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;ns1.pi-hole.net.               IN      TYPE65

;; AUTHORITY SECTION:
pi-hole.net.            3600    IN      SOA     ns1.pi-hole.net. hostmaster.pi-hole.net. 2022011805 7200 900 1209600 900

;; Query time: 84 msec
;; SERVER: 127.0.0.1#5392(127.0.0.1)
;; WHEN: lun. mai 16 10:35:20 CEST 2022
;; MSG SIZE  rcvd: 91

versions.pi-hole.net

pi@Raspberry:/opt/dnscrypt-proxy $ dig -p 5392 txt versions.pi-hole.net

; <<>> DiG 9.11.5-P4-5.1+deb10u6-Raspbian <<>> -p 5392 txt versions.pi-hole.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10991
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;versions.pi-hole.net.          IN      TXT

;; ANSWER SECTION:
versions.pi-hole.net.   300     IN      TXT     "Raspbian=9,10,11 Ubuntu=16,18,20,21 Debian=9,10,11 Fedora=33,34 CentOS=7,8"

;; Query time: 78 msec
;; SERVER: 127.0.0.1#5392(127.0.0.1)
;; WHEN: lun. mai 16 10:37:22 CEST 2022
;; MSG SIZE  rcvd: 136

/var/log/dnscrypt-proxy.log No problems there

pi@Raspberry:/opt/dnscrypt-proxy $ tail -f /var/log/dnscrypt-proxy.log
[2022-05-16 09:51:36] [NOTICE] Anonymizing queries for [odoh-koki-se] via [odohrelay-koki-ams]
[2022-05-16 09:51:37] [INFO] [odoh-koki-se] TLS version: 304 - Protocol: h2 - Cipher suite: 4867
[2022-05-16 09:51:37] [INFO] [odoh-koki-se] OK (ODoH) - rtt: 83ms
[2022-05-16 09:51:37] [NOTICE] Sorted latencies:
[2022-05-16 09:51:37] [NOTICE] -    56ms odoh-crypto-sx
[2022-05-16 09:51:37] [NOTICE] -    64ms odoh-cloudflare
[2022-05-16 09:51:37] [NOTICE] -    78ms odoh-ibksturm
[2022-05-16 09:51:37] [NOTICE] -    83ms odoh-koki-se
[2022-05-16 09:51:37] [NOTICE] -   106ms odoh-koki-es
[2022-05-16 09:51:37] [NOTICE] Server with the lowest initial latency: odoh-crypto-sx (rtt: 56ms)

[Kylvan-8]

@jedisct1 Frank, do you think this issue should be addressed on pi-hole Discourse ?

[jedisct1]

The dig results show that dnscrypt-proxy properly resolves your queries.

[Kylvan-8]

Allright, sorry, my time & date was broke that is why sig was " not yet " valid.

Everything works fine from now.

Thank you kindly for your answers !