Google DNS Refused AAAA queries from IPv6 clients

[7cio]

Hello,

I'm running AdGuardHome version: v0.106.3

While AAAA queries work for IPv6 clients if using Quad 9, Cloudflare as upstream DNS. It doesn't work with Google DNS

Anyone has the same problems? Is there any workaround to get it works?

Thanks.

[ainar-g]

Hello. At first sight, this looks like either a GoogleDNS issue or an ISP issue, to be honest. Can you check if making such requests from these machines also results in a REFUSED response? For example:

dig 'fpc.msedge.net' '8.8.8.8'

And:

dig +dnssec 'fpc.msedge.net' '8.8.8.8'

[7cio]

both commands work well on AdguardHome server and the clients

I've tested another AdguardHome install, and on a different network. It has the same problems.

[ainar-g]

I see. What if you explicitly request the AAAA responses?

dig +dnssec @'8.8.8.8' 'fpc.msedge.net' AAAA IN

[7cio]

It works too

Adguard Home server

One of the clients

[ainar-g]

You could also try one of the v0.107 betas to see if that improves the situation, but other than that we don't have any other ideas, unfortunately. I'll leave the issue open with the “help needed” label, and perhaps someone who solved a similar issue could shed some light.

[7cio]

I found out that Google DNS process AAAA queries from IPv4 clients

And refuse if the queries from IPv6 clients

The same thing happens with Google DNS6
2001:4860:4860::8888
2001:4860:4860::8844

If I set the Google DNS directly on IPv6 clients, it works.

I've tested 3 different Adguard Home instances on 3 different countries. And they have the same problem with Google DNS and IPv6 clients.

I believe the dev team can reproduce the problem. So please check.

[ainar-g]

@vNa3006, thank you for the tests! We have a theory. Do you have the “Enable EDNS client subnet” option on? Does the problem still persist if you disable it?

[7cio]

@ainar-g, yes I have the “Enable EDNS client subnet” option on.
If I disable the option, the problem doesn't occur.

[ainar-g]

I see. It's probably a bug in one of our libraries then.

@EugeneOne1, please investigate.

[EugeneOne1]

@vNa3006, hello again. This should be fixed as of latest edge build. Could you please install it and check if IPv6 clients now getting their responses?

[7cio]

@EugeneOne1 It's working on the edge version. Thanks.

[EugeneOne1]

@vNa3006, I'll close the issue for now. Thanks for testing!