High CPU load hassio_dns Container

Installation Home Assistant OS
15

Hi @CentralCommand, I’ve been able to root cause the runaway DNS queries as a result of what I call infinite looping configuration in /etc/corefile. The lines of configuration that are contributing to this issue are loop, fallback REFUSED,NXDOMAIN, and max_fails 0. Here’s what happens:

  1. CoreDNS starts and executes the loop plugin, which sends a query for <random number>.<random number>.zone that gets forwarded externally and the Root Servers respond with NXDOMAIN.

  2. CoreDNS triggers the fallback plugin due to the NXDOMAIN response.

  3. CoreDNS now sends all queries, including health_check (NS IN .), to Cloudflare over TLS.

  4. User’s firewall blocks DNS over TLS (TCP 853).

  5. CoreDNS triggers the fallback plugin due to the REFUSED response.

  6. Since max_fails 0 is set, CoreDNS assumes Cloudflare is always healthy.

  7. CoreDNS is now in an infinite loop continuously sending and retrying its health_check query. :nauseated_face:

Initial thoughts for a PR to fix this are:

  1. HINFO query from the loop plugin should not trigger fallback.
  2. Allow users to specify whether or not to use DNS or TLS when configuring the plugin-dns container.
  3. Don’t assume Cloudflare will always be available.
  4. [Unrelated]: Remove policy sequential so not to overload a single user’s DNS server.

Although, before reworking this configuration, is the narrative on why plugin-dns exists in the first place is to provide continuous access to well-functioning and available DNS servers?

1 Like