Excessive amount of DNS queries to domainname of metric server

[songworks]

Hello there!

I've setup a Proxmox VE machine to send metrics to a local InfluxDB instance.
Said instance is served with a domainname over HTTPS.
Said domainname is resolved as a DNS rewrite by a local Adguard instance.

So far so good, nothing special about any of it really and it works as expected.

Yesterday, I've noticed an excessive amount of DNS queries (~50000 queries, ~70% of all in a 24h timeframe) for the domainname of the InfluxDB instance and all coming from the Proxmox machine.
Apparently around every ten seconds (when the metrics are transmitted?) Proxmox does some eight A & AAAA DNS queries for the domainname. Every time.


Any idea what's happening there?
Shouldn't DNS responses be cached in Proxmox (/OS?) somehow?


For now I've added the IP and domainname to /etc/hosts on the Proxmox machine. At least that way it stops querying DNS constantly.
But I'd prefer to have all my IP/domainname-eggs in the same Adguard-basket.


Any idea how I can get it running through DNS properly, without it flooding Adguard?
Maybe some caching I'm missing or deactivated in error, or some such?


I've found a german thread [1] about the same issue from years back. Doesn't read like it went anywhere though.


Some information:
Proxmox VE 8.3.4
Adguard, InfluxDB & Traefik (for serving the others over HTTPS) running in a VM on the Proxmox machine.
What else might be interesting?


Cheers!

[1] https://forum.proxmox.com/threads/aktiver-metric-server-flutet-dns-server-mit-anfragen.100713/

 

[BobhWasatch]

Shouldn't DNS responses be cached in Proxmox (/OS?) somehow?

Not by default, no. There are DNS caching daemons you can install via apt if it really bothers you. Then you will find out the subtleties of that. It isn't as obvious as you clearly think. And the queries will still be made, they just won't go over the network.

Any idea how I can get it running through DNS properly, without it flooding Adguard?

One query per two seconds on average is not "flooding", even if the Adguard is running on a micro-controller and you have a 10 mbit LAN.

 

[songworks]

Not by default, no.

But shouldn't it at least honor the Time-To-Live of the DNS records?

AdGuards default TTL for rewritten domains is 10 seconds.
Interestingly, that fit my timings with this issue.
So I changed it to something higher, but that made no apparent difference (it showed up in `dig` though).


I don't really care about the performance of the many queries.
I just don't want ~70% of my local, daily DNS traffic to be for one domain from one client.


Anyway, found another semi solution:
Adding the domain to "Ignored domains" for query & statistics logging in AdGuard.
That way I don't have to hardcode the IP & domain into the /etc/hosts and I don't have so much noise.
Out of sight, out of mind.


Still would prefer a better solution though.
I intend to have Proxmox Logs to be send to another domainname (through rsyslog, probably) too.
If this is an general issue that would add even more noise to my DNS logs, which I then have to ignore.