Strange upstream resolution behaviour

[Andrewkha]

Hello!
I'm using AdGuard home in my home network and observed some issues with DNS resolution.

I set the AGH IP 192.168.1.10 as my primary DNS server for devices in my network. I also configured upstream DNS servers in AGH as follows:

[/themoviedb.org/]9.9.9.9
[/tmdb.org/]9.9.9.9
1.1.1.1
8.8.8.8
9.9.9.9

And here the strange thing goes. For example, I'm trying to resolve facebook.com on my windows machine.

C:\Users\Andrewkha>nslookup facebook.com 192.168.1.10
Server:  4d9aa09a0478
Address:  192.168.1.10

Non-authoritative answer:
Name:    facebook.com
Addresses:  2a01:54e0:fb00::301
          **188.186.146.207**

However, if I try each of the upstream servers, the result is different:

C:\Users\Andrewkha>nslookup facebook.com 1.1.1.1
Server:  one.one.one.one
Address:  1.1.1.1

Non-authoritative answer:
Name:    facebook.com
Addresses:  2a03:2880:f113:81:face:b00c:0:25de
          **31.13.72.36**


C:\Users\Andrewkha>nslookup facebook.com 8.8.8.8
Server:  dns.google
Address:  8.8.8.8

Non-authoritative answer:
Name:    facebook.com
Addresses:  2a03:2880:f10a:83:face:b00c:0:25de
          **31.13.72.36**


C:\Users\Andrewkha>nslookup facebook.com 9.9.9.9
Server:  dns9.quad9.net
Address:  9.9.9.9

Non-authoritative answer:
Name:    facebook.com
Addresses:  2a03:2880:f10a:83:face:b00c:0:25de
          **31.13.72.36**

I have cleared and disabled the cache within AGH. Nothing helpes. Where does it take 188.186.146.207 from?

[EugeneOne1]

Hello @Andrewkha, the IP address appears to return a 'forbidden resource' error page. I would assume that the machine serving AGH (192.168.1.10) receives different routes to the specified upstreams and gets a filtered DNS response somehow. Alternatively, perhaps AGH cannot connect to the upstreams and switches to the fallback, which receives this blocked response. It's hard to tell for sure unless we take a look at the verbose log from your AGH.

[Andrewkha]

@EugeneOne1 thanks a lot for a quick response. I do not have any fallback DNS servers configured. I will also check the verbose logging you recommended. One more thing I'd mention. In the ADH query log I see the following records when trying to resolve facebook (maybe this helps...):

Response details
Status
Processed
DNS server
9.9.9.9:53
Elapsed
2 ms
Response code
NOERROR
Response
A: 188.186.146.207 (ttl=600)

Response details
Status
Processed
DNS server
1.1.1.1:53
Elapsed
1 ms
Response code
NOERROR
Response
AAAA: 2a01:54e0:fb00::301 (ttl=600)

[Andrewkha]

Hi @EugeneOne1
As you recommended I collected the verbose logs from my AGH. But frankly speaking, I didn't find anything suspecious there... It seems to me that AGH really queries the configured upstreams 1.1.1.1 and 8.8.8.8 and gets the response from them. And the response is still not the one which I'd expect. Here's a small extract from the log, and I will also attach the full one. I'm not the expert hereand would appreciate if you could have a look. Thanks in advance

PS ooops sorry. the extract was pasted with broken formatting, please refer to the complete log attached

2026/07/10 08:33:31.041602 1#201 [debug] dnsproxy: in line_num=4 line=";; QUESTION SECTION:" 2026/07/10 08:33:31.041796 1#201 [debug] dnsproxy: in line_num=5 line=";facebook.com.\tIN\t A" 2026/07/10 08:33:31.041985 1#201 [debug] dnsproxy: in line_num=6 line="" 2026/07/10 08:33:31.042302 1#201 [debug] started processing initial id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.042720 1#19 [debug] addrproc: processing rdns ip=10.9.0.2 2026/07/10 08:33:31.042859 1#201 [debug] client_storage: no client filtering settings found clientid="" addr=10.9.0.2 2026/07/10 08:33:31.042978 1#19 [debug] addrproc: finished processing rdns ip=10.9.0.2 host="" elapsed=299.719µs 2026/07/10 08:33:31.043345 1#201 [debug] finished processing initial id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.043371 1#19 [debug] addrproc: processing whois ip=10.9.0.2 2026/07/10 08:33:31.043729 1#19 [debug] addrproc: finished processing whois ip=10.9.0.2 whois=<nil> elapsed=394.7µs 2026/07/10 08:33:31.043804 1#201 [debug] started processing ddr id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.044060 1#201 [debug] finished processing ddr id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.044312 1#201 [debug] started processing dhcp hosts id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.044575 1#201 [debug] finished processing dhcp hosts id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.044823 1#201 [debug] started processing dhcp addrs id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.045072 1#201 [debug] finished processing dhcp addrs id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.045319 1#201 [debug] started processing filtering before request id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.045869 1#201 [debug] finished processing filtering before request id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.046143 1#201 [debug] started processing upstream id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.046427 1#201 [debug] dnsproxy: not caching reason="caching disabled: neither global cache nor custom upstreams cache is configured" 2026/07/10 08:33:31.046830 1#203 [debug] dnsproxy: sending request upstream_type=main addr=8.8.8.8:53 proto=udp qtype=A qname=facebook.com. id=2 2026/07/10 08:33:31.046909 1#202 [debug] dnsproxy: sending request upstream_type=main addr=1.1.1.1:53 proto=udp qtype=A qname=facebook.com. id=2 2026/07/10 08:33:31.047092 1#203 [debug] bootstrap: dialing upstream_type=main addr=8.8.8.8:53 idx=1 total=1 2026/07/10 08:33:31.047192 1#202 [debug] bootstrap: dialing upstream_type=main addr=1.1.1.1:53 idx=1 total=1 2026/07/10 08:33:31.047632 1#202 [debug] bootstrap: connection succeeded upstream_type=main addr=1.1.1.1:53 elapsed=104.481µs 2026/07/10 08:33:31.047691 1#203 [debug] bootstrap: connection succeeded upstream_type=main addr=8.8.8.8:53 elapsed=193.535µs 2026/07/10 08:33:31.049280 1#203 [debug] dnsproxy: response received upstream_type=main addr=8.8.8.8:53 proto=udp status=ok 2026/07/10 08:33:31.049883 1#201 [debug] dnsproxy: resolved upstream=8.8.8.8:53 src=upstream 2026/07/10 08:33:31.049894 1#202 [debug] dnsproxy: response received upstream_type=main addr=1.1.1.1:53 proto=udp status=ok 2026/07/10 08:33:31.050210 1#201 [debug] finished processing upstream id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.050466 1#201 [debug] started processing filtering after response id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.050892 1#201 [debug] checked id=2 qtype=A target=facebook.com. name=facebook.com. 2026/07/10 08:33:31.051149 1#201 [debug] finished processing filtering after response id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.051400 1#201 [debug] started processing id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.051653 1#201 [debug] finished processing id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.051902 1#201 [debug] started processing querylog and stats id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.052163 1#201 [debug] client ip for stats and querylog id=2 qtype=A target=facebook.com. ip=10.9.0.2 2026/07/10 08:33:31.052574 1#201 [debug] finished processing querylog and stats id=2 qtype=A target=facebook.com. 2026/07/10 08:33:31.052814 1#201 [debug] dnsproxy: out line_num=1 line=";; opcode: QUERY, status: NOERROR, id: 2" 2026/07/10 08:33:31.053007 1#201 [debug] dnsproxy: out line_num=2 line=";; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0" 2026/07/10 08:33:31.053194 1#201 [debug] dnsproxy: out line_num=3 line="" 2026/07/10 08:33:31.053382 1#201 [debug] dnsproxy: out line_num=4 line=";; QUESTION SECTION:" 2026/07/10 08:33:31.053603 1#201 [debug] dnsproxy: out line_num=5 line=";facebook.com.\tIN\t A" 2026/07/10 08:33:31.053805 1#201 [debug] dnsproxy: out line_num=6 line="" 2026/07/10 08:33:31.054017 1#201 [debug] dnsproxy: out line_num=7 line=";; ANSWER SECTION:" 2026/07/10 08:33:31.054211 1#201 [debug] dnsproxy: out line_num=8 line="facebook.com.\t600\tIN\tA\t188.186.146.207"
verbose.log