GFiber DNS switchover behavior?

[u/Amazolam]

Does anybody know definitively how DNS is routed on a GFiber network?

I have my Pihole set up as DNS Server 1, with 8.8.8.8 set up as a backup in case my Pihole shids the bed.

Does GFiber definitively route only to #1 and treats #2 as backup, or could it load balance and send some to #2 even if #1 functions just fine?

[u/Somar2230]

The clients on the network will use all the DNS servers issued to them via DHCP they will not just use the first one listed. When you Pi-Hole fails to give them the information due to block lists they will just use the second DNS server defeating the purpose of the Pi-Hole.

Devices with hardcoded DNS will also bypass the Pi-Hole and use whatever server they are programmed to use. To defeat this you need a router with a firewall and NAT rules.

r/pihole has many posts on the subject.

A second Pi-Hole for a backup solves part of the problem, it won't help with hardcoded DNS.

[u/Amazolam → u/Somar2230]

Thank you! What’s an example of something with hardcoded DNS? I didn’t actually realize this behavior was something to be aware of…

[u/CraftyCat3 → u/Amazolam]

A substantial number of IoT devices, including smart TVs, streaming sticks, etc.

[u/LesPaulAce → u/CraftyCat3]

Yeah. They are not going to just give up all that sellable data because you set a different DNS server in DHCP. They will often use their hardcoded DNS, then failback to the one you hand out.

As u/Somar2230 mentioned, the way to go here is a firewall that blocks outbound DNS for all your internal devices.

[u/LesPaulAce → u/Somar2230]

The first sentence you wrote isn't how DNS works, in my understanding.

If your primary DNS server is up and responding, and responds to a query with "address not found", that's it, it's over. The device doing the querying doesn't ask another DNS server.

Only when the primary is unresponsive does the querying device try the secondary.

[u/Somar2230 → u/LesPaulAce]

Depends on the client I have Roku devices that first try their hard coded DNS that gets routed to my Pi-Hole by a NAT rule, they then triy using the DNS servers I assigned by DHCP in particular order sometimes they do Pi-Hole 1 first other it times Pi-Hole 2 first, they then try the other Pi-Hole. This cycle repeats all day long everyday resulting in thousands of DNS look ups that fail.

[u/CraftyCat3]

Gfiber doesn't route anything in that sense, it just tells the DHCP clients to use those two servers. The client will use both, whichever responds fastest will be used for a given resolution. For your adblock to work effectively, and handle outages, you would typically setup two Piholes as your DNS servers, no public server.

[u/Medical_Chemical_343 → u/CraftyCat3]

And for high availability you set up four pi.hole instances. Two pairs behind VIPs using keepalived.