[GH-ISSUE #5960] [BUG] Netbird Resolver fails on NX Domain blocked domains #12543

Open
opened 2026-08-05 02:06:08 -04:00 by saavagebueno · 0 comments
Owner

Originally created by @dasunsrule32 on GitHub (Apr 21, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5960

Describe the problem

Netbird Resolver fails on NX Domain blocked domains from upstream DNS Servers (Technitium in this instance). When switching to ANY Address blocking sites work correctly. With NX Domain blocking enabled sites will often not load all the way or not load at all. One common side effects are the browser just spinning when the site looks like it's loaded, etc.

I can reproduce it 100% of the time on https://www.crunchlabs.com. It will look like it's loaded, but continue to load in the browser. As soon as I turn of NX Domain blocking and switch it to ANY Address blocking, DNS works correctly.

To Reproduce

Steps to reproduce the behavior:

Set Technitium to NX Domain for blocking and Netbird will fail with DNS timeouts.

Expected behavior

Handle NX Doman blocking without issue.

Are you using NetBird Cloud?

Self hosted

NetBird version

Linux amd64

❯ netbird version
0.69.0

Is any other VPN software installed?

None.

Debug output

To help us resolve the problem, please attach the following anonymized status output

❯ netbird status -dA
Peers detail:
 erbridge02.nb.anon-16ZKx.domain:
  NetBird IP: 100.93.4.51
  Public key: 7Om7TrWwZgUS6i96yjiCKhySO5r81dHyYoFHrp4LwF8=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/host
  ICE candidate endpoints (Local/Remote): 192.168.2.91:51820/192.168.0.16:51820
  Relay server address: rels://nb.anon-EDbtu.domain:443
  Last connection update: 20 minutes, 20 seconds ago
  Last WireGuard handshake: 2 minutes, 46 seconds ago
  Transfer status (received/sent) 2.2 KiB/1.2 KiB
  Quantum resistance: false
  Networks: -
  Latency: 3.28441ms

 phone.nb.anon-16ZKx.domain:
  NetBird IP: 100.93.64.179
  Public key: HAU8LvgpIN2HDquFoP/M3GpnUJ+SIA7EmurVA7d3Ims=
  Status: Connecting
  -- detail --
  Connection type: -
  ICE candidate (Local/Remote): -/-
  ICE candidate endpoints (Local/Remote): -/-
  Relay server address: 
  Last connection update: 20 minutes, 20 seconds ago
  Last WireGuard handshake: -
  Transfer status (received/sent) 0 B/0 B
  Quantum resistance: false
  Networks: -
  Latency: 0s

 erbridge01.nb.anon-16ZKx.domain:
  NetBird IP: 100.93.152.145
  Public key: gn/o1BFcHkcBLqyAviZLVMjcv93jHjSPu5/sZ6X6zgM=
  Status: Connected
  -- detail --
  Connection type: P2P
  ICE candidate (Local/Remote): host/host
  ICE candidate endpoints (Local/Remote): 192.168.2.91:51820/192.168.0.15:51820
  Relay server address: rels://nb.anon-EDbtu.domain:443
  Last connection update: 20 minutes, 20 seconds ago
  Last WireGuard handshake: 2 minutes, 46 seconds ago
  Transfer status (received/sent) 2.2 KiB/1.2 KiB
  Quantum resistance: false
  Networks: -
  Latency: 3.347389ms

Events:
  [INFO] SYSTEM (67119bc8-aa36-4c89-bf45-4337cf062020)
    Message: Network map updated
    Time: 3 hours, 15 minutes ago
  [INFO] SYSTEM (18661706-5287-455b-a287-2fb01a36c76c)
    Message: Network map updated
    Time: 2 hours, 45 minutes ago
  [INFO] SYSTEM (3693e83b-84b6-4f9f-a7ea-a9e8fa9e7ca9)
    Message: Network map updated
    Time: 29 minutes, 15 seconds ago
  [INFO] SYSTEM (60873d7d-8531-4749-b0d2-89827970db49)
    Message: Network map updated
    Time: 20 minutes, 20 seconds ago
OS: linux/amd64
Daemon version: 0.69.0
CLI version: 0.69.0
Profile: default
Management: Connected to https://nb.anon-EDbtu.domain:443
Signal: Connected to https://nb.anon-EDbtu.domain:443
Relays: 
  [stun:nb.anon-EDbtu.domain:3478] is Available
  [rels://nb.anon-EDbtu.domain:443] is Available
Nameservers: 
FQDN: laptop.nb.anon-16ZKx.domain
NetBird IP: 100.93.47.233/16
Interface type: Kernel
Quantum resistance: false
Lazy connection: false
SSH Server: Disabled
Networks: -
Peers count: 2/3 Connected

Create and upload a debug bundle, and share the returned file key:

❯ netbird debug for 1m -AS -U
Log level set to trace.
netbird down
netbird up
Remaining time: 00:00:01
Duration completed
Creating debug bundle...
Log level restored to INFO
Local file:
/tmp/netbird.debug.4232545357.zip
Upload file key:
cb96708d64d0e100ed03ac53ba7038c12b5cf96efbdcff715dd44cd2db253b20/c5b70253-48df-406f-ae6f-e2e3f82ddf8b

Additional context

With NX Domain blocking enabled:

2026-04-21T22:00:48.256-04:00 ERRO [request_id: 4bcbc1a1, dns_id: 820d] client/internal/dns/upstream.go:313: 1/1 upstreams failed for domain=tvspix.com.: 127.0.0.53:53=timeout after 4s
2026-04-21T22:00:48.257-04:00 ERRO [request_id: 1b4cdcd1, dns_id: c1f7] client/internal/dns/upstream.go:313: 1/1 upstreams failed for domain=res4.applovin.com.: 127.0.0.53:53=timeout after 4s
2026-04-21T22:00:48.256-04:00 ERRO [dns_id: b64c, request_id: c87cef05] client/internal/dns/upstream.go:313: 1/1 upstreams failed for domain=res4.applovin.com.: 127.0.0.53:53=timeout after 4s
2026-04-21T22:00:48.256-04:00 ERRO [request_id: 9d767f35, dns_id: 058a] client/internal/dns/upstream.go:313: 1/1 upstreams failed for domain=tvspix.com.: 127.0.0.53:53=timeout after 4s
2026-04-21T22:00:48.257-04:00 ERRO [dns_id: 0125, request_id: 232400cb] client/internal/dns/upstream.go:313: 1/1 upstreams failed for domain=static.klaviyo.com.: 127.0.0.53:53=timeout after 4s
2026-04-21T22:00:48.257-04:00 ERRO [request_id: 10ab71fd, dns_id: 074d] client/internal/dns/upstream.go:313: 1/1 upstreams failed for domain=static.klaviyo.com.: 127.0.0.53:53=timeout after 4s

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @dasunsrule32 on GitHub (Apr 21, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5960 **Describe the problem** Netbird Resolver fails on `NX Domain` blocked domains from upstream DNS Servers (_Technitium_ in this instance). When switching to `ANY Address` blocking sites work correctly. With NX Domain blocking enabled sites will often not load all the way or not load at all. One common side effects are the browser just spinning when the site looks like it's loaded, etc. I can reproduce it 100% of the time on https://www.crunchlabs.com. It will look like it's loaded, but continue to load in the browser. As soon as I turn of `NX Domain` blocking and switch it to `ANY Address` blocking, DNS works correctly. **To Reproduce** Steps to reproduce the behavior: Set Technitium to `NX Domain` for blocking and Netbird will fail with DNS timeouts. **Expected behavior** Handle `NX Doman` blocking without issue. **Are you using NetBird Cloud?** Self hosted **NetBird version** Linux amd64 ``` ❯ netbird version 0.69.0 ``` **Is any other VPN software installed?** None. **Debug output** To help us resolve the problem, please attach the following anonymized status output ``` ❯ netbird status -dA Peers detail: erbridge02.nb.anon-16ZKx.domain: NetBird IP: 100.93.4.51 Public key: 7Om7TrWwZgUS6i96yjiCKhySO5r81dHyYoFHrp4LwF8= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/host ICE candidate endpoints (Local/Remote): 192.168.2.91:51820/192.168.0.16:51820 Relay server address: rels://nb.anon-EDbtu.domain:443 Last connection update: 20 minutes, 20 seconds ago Last WireGuard handshake: 2 minutes, 46 seconds ago Transfer status (received/sent) 2.2 KiB/1.2 KiB Quantum resistance: false Networks: - Latency: 3.28441ms phone.nb.anon-16ZKx.domain: NetBird IP: 100.93.64.179 Public key: HAU8LvgpIN2HDquFoP/M3GpnUJ+SIA7EmurVA7d3Ims= Status: Connecting -- detail -- Connection type: - ICE candidate (Local/Remote): -/- ICE candidate endpoints (Local/Remote): -/- Relay server address: Last connection update: 20 minutes, 20 seconds ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B Quantum resistance: false Networks: - Latency: 0s erbridge01.nb.anon-16ZKx.domain: NetBird IP: 100.93.152.145 Public key: gn/o1BFcHkcBLqyAviZLVMjcv93jHjSPu5/sZ6X6zgM= Status: Connected -- detail -- Connection type: P2P ICE candidate (Local/Remote): host/host ICE candidate endpoints (Local/Remote): 192.168.2.91:51820/192.168.0.15:51820 Relay server address: rels://nb.anon-EDbtu.domain:443 Last connection update: 20 minutes, 20 seconds ago Last WireGuard handshake: 2 minutes, 46 seconds ago Transfer status (received/sent) 2.2 KiB/1.2 KiB Quantum resistance: false Networks: - Latency: 3.347389ms Events: [INFO] SYSTEM (67119bc8-aa36-4c89-bf45-4337cf062020) Message: Network map updated Time: 3 hours, 15 minutes ago [INFO] SYSTEM (18661706-5287-455b-a287-2fb01a36c76c) Message: Network map updated Time: 2 hours, 45 minutes ago [INFO] SYSTEM (3693e83b-84b6-4f9f-a7ea-a9e8fa9e7ca9) Message: Network map updated Time: 29 minutes, 15 seconds ago [INFO] SYSTEM (60873d7d-8531-4749-b0d2-89827970db49) Message: Network map updated Time: 20 minutes, 20 seconds ago OS: linux/amd64 Daemon version: 0.69.0 CLI version: 0.69.0 Profile: default Management: Connected to https://nb.anon-EDbtu.domain:443 Signal: Connected to https://nb.anon-EDbtu.domain:443 Relays: [stun:nb.anon-EDbtu.domain:3478] is Available [rels://nb.anon-EDbtu.domain:443] is Available Nameservers: FQDN: laptop.nb.anon-16ZKx.domain NetBird IP: 100.93.47.233/16 Interface type: Kernel Quantum resistance: false Lazy connection: false SSH Server: Disabled Networks: - Peers count: 2/3 Connected ``` Create and upload a debug bundle, and share the returned file key: ``` ❯ netbird debug for 1m -AS -U Log level set to trace. netbird down netbird up Remaining time: 00:00:01 Duration completed Creating debug bundle... Log level restored to INFO Local file: /tmp/netbird.debug.4232545357.zip Upload file key: cb96708d64d0e100ed03ac53ba7038c12b5cf96efbdcff715dd44cd2db253b20/c5b70253-48df-406f-ae6f-e2e3f82ddf8b ``` **Additional context** With NX Domain blocking enabled: ``` 2026-04-21T22:00:48.256-04:00 ERRO [request_id: 4bcbc1a1, dns_id: 820d] client/internal/dns/upstream.go:313: 1/1 upstreams failed for domain=tvspix.com.: 127.0.0.53:53=timeout after 4s 2026-04-21T22:00:48.257-04:00 ERRO [request_id: 1b4cdcd1, dns_id: c1f7] client/internal/dns/upstream.go:313: 1/1 upstreams failed for domain=res4.applovin.com.: 127.0.0.53:53=timeout after 4s 2026-04-21T22:00:48.256-04:00 ERRO [dns_id: b64c, request_id: c87cef05] client/internal/dns/upstream.go:313: 1/1 upstreams failed for domain=res4.applovin.com.: 127.0.0.53:53=timeout after 4s 2026-04-21T22:00:48.256-04:00 ERRO [request_id: 9d767f35, dns_id: 058a] client/internal/dns/upstream.go:313: 1/1 upstreams failed for domain=tvspix.com.: 127.0.0.53:53=timeout after 4s 2026-04-21T22:00:48.257-04:00 ERRO [dns_id: 0125, request_id: 232400cb] client/internal/dns/upstream.go:313: 1/1 upstreams failed for domain=static.klaviyo.com.: 127.0.0.53:53=timeout after 4s 2026-04-21T22:00:48.257-04:00 ERRO [request_id: 10ab71fd, dns_id: 074d] client/internal/dns/upstream.go:313: 1/1 upstreams failed for domain=static.klaviyo.com.: 127.0.0.53:53=timeout after 4s ``` **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 02:06:08 -04:00
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#12543