The issue is that according to the spec the two DNS servers provided by DHCP are equivalent. While most clients favor the first one as the default, that's not universally the case and when and how it switches to the secondary can vary by client (and effectively appear random). So you won't be able to know for sure which client uses your DNS, especially after your DNS server was unreachable for a while for whatever reason. Personally I've "just" gotten a second Pi to run redundant copies of PiHole, but only having a single DNS server is usually fine as well.
this post was submitted on 17 Jan 2024
29 points (96.8% liked)
Selfhosted
40152 readers
545 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 1 year ago
MODERATORS
This answered my question. Thank you. I guess I will sacrifice redundancy
Or set up a second pi-hole.
I run multiple pinholes using keepalived. Then I only use one DNS in my DHCP server. Second pihole will seemlessly take over if the first one goes down whilst using the original DNS address.
Work quite well. I had to learn the hard way that only using a single pihole was just asking for my partner to be mad when it didn't work / when I was doing server maintenance. Now I have multiple and they can all seemlessly take over if any my server nodes are down
How do you manage automatically transferring the ip of the main rpi to the backup rpi when the first disappears?
Keepalived
clone the Mac address
Don't you then run into MAC conflicts?
How do you keep both on the network?
oh. fuck.
Arduino? lol
I'm just spit balling here: backup pi pings munute-ly main pi. if main pi is down 2 pings, it resets Mac and reboots network interface.
Then when the main PI returns it creates a conflict...
oh hm...
hmmm
ok. both pis know the live IP and the backup IP, and have the same config: cold boot into backup I and ping live ip
Keepalived is the way. Gravity sync keeps everything in line. Works like a charm. I migrated yesterday from wifi to wired and cannot be happier. As a bonus did not need to reconfigure pivpn.
I would avoid it, as it may use the alternate instead of the pihole at anytime. If you want redundancy, it’s best to have a second pihole.
I tried that, devices just request to alternate dns when they get nothing from pihole. I use adgh, and ig there is a setting where you can set the answer to blocked stuff, like 0.0.0.0, empty..etc. if you set thay to 0.0.0.0, devices won't query 2nd dns (i hope) when adgh is up. But it is best to have a 2nd pihole/adgh, i have one on my proxmox and another on a pi, synced with adgh sync Edit: if you don't have another pi, use nextdns
I setup a second pihole for redundancy.
90% of network traffic uses the primary, but some things like to use both or exclusively the secomd one on random days.
I use Gravity-Sync to keep the settings/lists between them identical. (lots of local dns records for local self-hosted stuff, and each device has a static ip + dns record to identify it easily in logs)
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:
| Fewer Letters | More Letters |
|---|---|
| DNS | Domain Name Service/System |
| PiHole | Network-wide ad-blocker (DNS sinkhole) |
| VPS | Virtual Private Server (opposed to shared hosting) |
[Thread #433 for this sub, first seen 17th Jan 2024, 09:35] [FAQ] [Full list] [Contact] [Source code]
mary DNS Server: Clients will first attempt to use the primary DNS server specified in their network settings. This ser
What's the point tho? If your PiHole fails you need to know otherwise you could be risking days / months of web surfing in the fallback DNS server without even noticing it.
As for a reply, there’s no RFC that specifies that a specific order is applied to DNS servers. So in short, you can't have a fallback that is reliable and most operating systems will just load balance or opportunistically pick between the two.
Thank you, this is what I was worrying about. As for the "why", even if my server is quite stable, a shutdown may be necessary and sometimes slowdowns with pi-hole happened. Some redundancy would have been better.
Setup two PiHoles
Well, I'm not sure you read the other comments but there is confirmation that for clients there isn't an order for DNS servers from RFC2182:
The distinction between primary and secondary servers is relevant only to the servers for the zone concerned, to the rest of the DNS there are simply multiple servers.
All are treated equally at first instance, even by the parent server that delegates the zone. Resolvers often measure the performance of the various servers, choose the “best”, for some definition of best, and prefer that one for most queries.
You should put your pihole server in the dns server in the network settings. My mobile devices didn't use my pihole server until I changed the dns server configured there... (I am using a FritzBox as well)
I've set my secondary DNS to cloudflare, and my pihole still blocked ads for me. I assumed the secondary DNS server is used only if the primary can't be pinged. But i haven't actually looked into it.
I have two piholes, and sometimes both will receive requests at the same time, if there’s a lot of traffic.
Yeah this is what I do.
Putting Cloudflare as my secondary would allow some requests to get through and then often the device whose requests went to Cloudflare would continue using Cloudflare for a while.
The best solution I found was to run a second Pihole and use it as the secondary.
You can use something like orbital sync to keep them syncronized
Pretty much. Not sure how the router determines which DNS to use, but mine seems to latch onto whichever one serves up results the fastest, which would inevitably be cloudflare direct after the pihole returns enough blocks.
So I use a Raspberry Pi Zero W as a dedicated pihole, and my Pi 4 seedbox acts as its own pihole and as a redundant backup. Then use gravity-sync from the Zero to the 4 to mirror the settings.
Another cool trick is using tailscale to ensure your portable devices always can access your Pihole(s) from anywhere and then setting those server's tailscale addresses as your DNS servers in tailscale.
This way you can always use your DNS from anywhere, even on cell data or on public networks
I keep a third instance of Pihole running on a VPS and use it as the first DNS server in tailscale so it will resolve a bit faster than my local DNS servers when I'm away from home
Huh, I’ll definitely look into that. Both times I tried to route external pihole access, somehow other mystery services found it and it slowed to a crawl from getting absolutely pounded by requests not from me. Thanks for that tip!
When it comes to a “secondary”DNS... there is nothing like a primary and secondary DNS server. These indications are quite misleading but many systems adopted it this way. Pihole only list the DNS servers as primary and secondary, because this is what the providers write on their pages. The bad phrasing is supported especially by how Windows handles it.
The ONLY DNS server you should have set on your network is a/the PiHole(s).
Thanks for the clarification. I'll be updating my settings.
Afaik there is no primary and secondary, you cant tell which one to use. Its best to have 2 piholes, but having 2nd DNS set to nextdns or something like that should be fine if you cant run 2 instances, probably not the best setup tho
When you specify more than one DNS server for network clients, the order in which these servers are used is not random. The following sequence is observed:
Primary DNS Server: Clients will first attempt to use the primary DNS server specified in their network settings. This server is often considered the default.
Secondary DNS Server: If the primary DNS server is unavailable or unable to resolve a query, clients will then attempt to use the secondary DNS server. This server acts as a backup.
So in OPs case his Pihole will always be used if it's available, and only when it's not will the secondary be used.
Except that, as I’ve already mentioned, I have two piholes, and sometimes both will be receiving requests. Based on your description, the second would never receive requests as long as the first is online. Perhaps this is router dependent, but it’s what I’ve observed.
There's no RFC that specifies that a specific order is applied to DNS servers.
RFC 2182 details the operation and functionality of secondary DNS servers. Which defines/influences how resolvers behave with multiple DNS servers.
When it comes to a “secondary”DNS... there is nothing like a primary and secondary DNS server. These indications are quite misleading but many systems adopted it this way. Pihole only list the DNS servers as primary and secondary, because this is what the providers write on their pages. The bad phrasing is supported especially by how Windows handles it.
The ONLY DNS server you should have set on your network is a/the PiHole(s).
A number of problems in DNS operations today are attributable to poor choices of secondary servers for DNS zones
That RFC is about DNS servers in the context of DNS zones in domain names. Not for a DNS client running DNS queries like an operating system. And the RFC is very clear about this:
The distinction between primary and secondary servers is relevant only to the servers for the zone concerned, to the rest of the DNS there are simply multiple servers.
For your Windows, Linux whatever machine "there are simply multiple DNS servers".
Which defines/influences how resolvers behave with multiple DNS servers.
It doesn't. As I said in another comment "most operating systems will just load balance or opportunistically pick between the two", and there's the relevant part from the RFC:
All are treated equally at first instance, even by the parent server that delegates the zone. Resolvers often measure the performance of the various servers, choose the "best", for some definition of best, and prefer that one for most queries.
What you stated is generally a Windows only feature. Other OSes don’t adhere to that. Drives me crazy on Windows Servers too.
https://fritzhelp.avm.de/help/en/FRITZ-Box-7530-AX-avme/avme/021/hilfe_internet_public_dns I found this guide for the fritz!box to set up a fallback dns, I think it should be on by default as it is on mine but I would read the article just to make sure
uh! this is interesting! I'm gonna look into this. Thanks!
When it comes to a “secondary”DNS... there is nothing like a primary and secondary DNS server. These indications are quite misleading but many systems adopted it this way. Pihole only list the DNS servers as primary and secondary, because this is what the providers write on their pages. The bad phrasing is supported especially by how Windows handles it.
The ONLY DNS server you should have set on your network is a/the PiHole(s).
I'm not sure if this is a response to my comment but the article I linked isn't about setting a secondary dns, the fritz!box has a function that allows it to temporarily change the dns (usually to 8.8.8.8) if the specified dns isn't working. It is separate from the "normal" dns settings.
Not sure about that as I never used/seen a Fritzbox, but I stand by “ The ONLY DNS server you should have set on your network is a/the PiHole(s).”
AFAIK the FritzBox switchs mainly to the faster DNS Server. I tried to use Quad9 with cloudfare as the second DNS server, most of the time cloudfare was the used since it was a bit faster.