Improve Privacy, Stop using hardcoded DNS

[avd706]

At this point, its better to modify to sources to shut this off.

[Tommmii]

A brave move. Best of luck.

[Swallowtail (Simon)]

@Tommmii

CoreDNS will , for no detectable reason start using the hardcoded fallback. (This is bad, but workable)
The real gotcha is, that it will never revert back to original configuration, but stay stuck on the fallback.

This has just happened on mine… I have a DHCP-assigned static IP with a client option set for localised managed DNS, including RPZ for local network protection. At some point in the last couple of days, even though it’s still seeing the local DNS server, it no longer uses it at all…

So now none of my RPZ overwrites work, and none of my local DNS resolves. I now have to go through SMTP automations and rewrite them with hardcoded IPs because HA no longer resolves properly.

I’m struggling to come up with a reasonable idea on why someone thought this was a good idea.

[le_top]

In my old post about this I indicated how I reconfigured ha using

 ha dns option --servers dns://10.33.2.254 --servers dns://80.80.80.80 --servers dns://80.80.81.81

and also by adding a rule to my firewall.

HA OS DNS Setting - Configuration not respected?

I am surprised about the network address resolution in HA. I have an OPNSense firewall that provides its own IP as the DNS server and when examining the DNS configuration using ha dns info, I get: [core-ssh ~]$ ha dns info host: 172.30.32.3 locals: - dns://10.33.2.254 servers: [] update_available: false version: 2021.06.0 version_latest: 2021.06.0 On my firewall, I override some DNS entries to point to the local network address (10.X.X.X) rather than the public (dynamic) network address. So …

[tescophil (Phil)]

Many thanks to @CentralCommand for implementing an option to disable the fallback in version 2022.05.0 of the supervisor. Its been a long road, but we finally got there.

SSH into your HA instance and simply type:

ha dns options --fallback=false

No more fallback…, job done

[CentralCommand (Mike)]

Yep, that’s it!

My one suggestion for those reading this, please run the following command first:

ha resolution info

I put in some checks which test user-provided DNS servers to ensure they don’t have issues. The check for the situation I described here in particular is not obvious. It’s entirely possible that your local DNS server has this issue and you’ve never noticed since it only affects musl systems.

So please run that command and make sure no dns server issues are in the list. If there are none then feel free to disable the fallback.

If there are then I would strongly advise fixing those first otherwise you may have unexpected issues. Particularly around updating and installing containers since queries for github.com and ghcr.io resolve on A queries but not AAAA. If you do have the ipv6 issue I linked and you disable the fallback anyway you likely will see all your HA containers suddenly start to think github.com and ghcr.io don’t exist and hit a lot of problems.

[petro]

Because this feature request has been implemented, please make new posts for support on this. This FR is formally closed.