How one can diagnose why rdns frequently drops to fallback DNS?

[onetimecontributor]

Hi! v0.5.5t, I observe unexpectedly high (more than 3/4 subjectively) amount of queries resolved by fallback DNS (coming from non-bypassed apps).
My config is as follows:

• WG in advanced
• DNS is set to Other DNS (nextDNS DoT)
• split DNS OFF
• never proxy DNS OFF
• prevent DNS leaks ON
• use fallback DNS as bypass ON
• fallback DNS is set to Rethink
• use system for undelegated OFF (not relevant)
• on-device blockslists (not relevant)
• loopback OFF

Apart from negative impact of nextDNS not applying my custom rules, it also increases load/costs on rethinkdns infra.

How can I diagnose the reason for such a behavior? What to look for in logs? On a screenshots I have sample logs for both falled back and expected behaviors when I try to run DNS leak tests on Surfshark web page (DNS resolved as expected via upstream) and on Mullvad web page (falling back to rethinkdns).

upstream nexdns:

fallback:

[ignoramous]

The use of Configure -> Network -> Fallback DNS (which is really "Bootstrap DNS" used by Rethink itself) was not fully, totally, properly reported in versions prior to v055o, especially when Configure -> Network -> Loopback was also turned OFF.

Frequent use of Fallback DNS is normal iff:

1. It is the Rethink app itself using it. v055o onwards, on Android 12+ devices, Configure -> Logs -> DNS should also accurately show app names against each, individual DNS queries.
2. DNSCrypt is the user-preferred upstream, which is then "failing" (to connect over a DNSCrypt Relay, or to refresh its "certificate" which must succeed once every 20h).

[onetimecontributor]

1. It's variety of apps, too many (whatsapp, Google framework, etc) that are using that fallback dns. That actually worries me.
2. DNSCrypt? It's DoT nextDNS, and those fallbacks are used almost constantly, definitely not once per 20hrs.

any other ways to analyze?

[ignoramous]

In DoT's case, I am not sure why Rethink would use "Fallback DNS" in its stead that often.

The only way to get to the bottom of this is through logs. If you're technical enough:

# switch Rethink's log level to Very Verbose

Configure -> Settings -> Log level -> Very Verbose


# increase adb logs buffer to 16mb.
# the default is 256kb, which isn't enough.
# note: Android switches to the default after reboots.

adb logcat -G 16m


# and then, when you spot fallback being used,
# and the timeline was within the past 2 hours,
# capture the log output 

adb logcat > /path/to/file


# zip the file and email it to me, mz at celzero dot com
# do link this discussion in the email subject / body
# along with a screenshot from Configure -> Logs -> DNS
# showing "Fallback DNS" being used for other apps
# instead of NextDNS DNS-over-TLS 
# or: if a screenshot isn't possible, share the (local) timestamp
# of when "Fallback DNS" was used.

[onetimecontributor]

Will try, tnx. I was rather asking for a clue what to look for in the logs. Anyway, I'll try to review them myself with ai assistance. Tnx

[onetimecontributor]

on the 1st screenshot above, resolver 207.154.224.110 is nextdns, on the 2md 45.183.223.209 is a fallback

[ignoramous]

Gotcha. In v055v (soon), we try very hard to never have to "fallback" on some other DNS other than the ones user sets up.