Troubleshooting SERVER_TIMEOUTs and near timeouts

[tmo1]

Hi,

dnscrypt-proxy has been so unreliable for me that I've had to give it up, at least temporarily. I frequently find name resolution failing, and looking at the logs, I see lots of SERVER_TIMEOUTs to multiple servers, as well as lots of near timeouts (PASS lines with query times in the 135000-136000ms range). The problem seems to be intermittent - sometimes resolution works, with PASS lines with more or less normal query times.

When I first tried to hunt down the problem, I thought that I had traced it to a relay that had gone down, but the problem keeps recurring, even though my relays are currently on the official relay list:

routes = [
        { server_name='*', via=['anon-plan9-ns2', 'anon-acsacsar-ams-ipv4'] }
]

I'm not specifying any particular servers, just using the standard ones with these restrictions:

ipv4_servers = true
ipv6_servers = false
dnscrypt_servers = true
doh_servers = false
require_dnssec = true
require_nolog = true
require_nofilter = true
disabled_server_names = ['plan9-ns1', 'plan9-ns2', 'anon-plan9-dns', 'acsacsar-ams-ipv4', 'acsacsar-ams-ipv6']
odoh_servers = false

How should I troubleshoot this? More generally, I really want my DNS resolution to be set and forget - I can't use a solution that's going to keep requiring troubleshooting and tinkering.

FWIW, I chain pihole to dnscrypt-proxy. pihole chained to an upstream public resolver works fine, as does pihole chained to a local instance of unbound configured as a recursive resolver. pihole, unbound, and dnscrypt-proxy are all running as docker containers.

[bbatsche]

I’ve been running into similar issues, especially around retrieving DS records. I’m also wondering if one or more of the relays I’d selected is failing intermittently.

One idea that could be helpful for debugging: could the query log to be updated to include the relay that was used as well as the nameserver?

[lifenjoiner]

My suggestions are:
Don't use very few upstream servers or relays, if you can't get some good ones.
I guess many of those servers are hosted by somebody personally, that would be resource limited and less stable, comparing to Google, Quad9 or your ISP.
The default strategy is choosing 1 of the best 2 of dozens dynamically, and ranking the servers periodically.
You can exclude several, if they have issues.

[tmo1]

Don't use very few upstream servers or relays, if you can't get some good ones.

Yes - as I mentioned in my OP, I allow all upstream servers (that match the filters). I'm not sure what to do about relays, though. For every one I include, I'm supposed to exclude all servers run by the same organization - e.g., if I include even a single cryptostorm relay, I need to exclude all the CS servers. This is a hassle, and also means that I either have to reduce the number of resolvers I allow, or the number of relays.

[jedisct1]

There have been issues with the server software, that have been resolved in the latest version.

I'm hoping things to be stable again once people upgrade their servers.

[tmo1]

Thank you! I'll try dnscrypt-proxy again after allowing some time for those upgrades to (hopefully!) take place.