r/technitium • u/SnooOranges6925 • 8d ago
ipv6 only environment - forwarder config issue?
Hi All
I'm testing out dual technitium cluster (primary tdns1 + secondary node2 on IPv6-only gigadesk), DoT forwarders to Cloudflare/Quad9/NextDNS, consistent ~2000ms SERVFAIL with EDE 0 (Other): Waiting for resolver. Please try again, confirmed working TLS handshake to the forwarder from both host and container context via openssl s_client, and that it broke specifically after disabling IPv4 on one cluster node.
ruled out firewall, TLS/cert handshake (verified twice, including from inside the container), forwarder syntax (multiple formats tried), source addresses, IPv6 preference mode, and DNS bootstrap circularity, without landing on the actual cause.
basically.. running dual stack env on both nodes. on secondary node (gigadesk) i disabled ipv4. when the forwarder is ipv6 only (selected from list eg cloudflare tls ipv6) using dig command it would fail to get the records back. if i switch back to a ipv4 forwarders.. the node1 will work with dig. see below
rolandhuu@
~
09:58:17
❯
dig
:3456:7890:1::3
hp.com
; <<>> DiG 9.18.50 <<>> :3456:7890:1::3 hp.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48171
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;hp.com. IN A
;; ANSWER SECTION:
hp.com. 300 IN A 54.192.100.55
hp.com. 300 IN A 54.192.100.102
hp.com. 300 IN A 54.192.100.84
hp.com. 300 IN A 54.192.100.35
;; Query time: 63 msec
;; SERVER: fd12:3456:7890:1::3#53(fd12:3456:7890:1::3) (UDP)
;; WHEN: Tue Aug 25 10:05:20 +08 2026
;; MSG SIZE rcvd: 99
rolandhuu@
~
10:05:20
❯
dig
:3456:7890:1::20
hp.com
; <<>> DiG 9.18.50 <<>> @ ~ 09:58:17
❯ dig :3456:7890:1::3 hp.com
; <<>> DiG 9.18.50 <<>> :3456:7890:1::3 hp.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48171
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;hp.com. IN A
;; ANSWER SECTION:
hp.com. 300 IN A 54.192.100.55
hp.com. 300 IN A 54.192.100.102
hp.com. 300 IN A 54.192.100.84
hp.com. 300 IN A 54.192.100.35
;; Query time: 63 msec
;; SERVER: fd12:3456:7890:1::3#53(fd12:3456:7890:1::3) (UDP)
;; WHEN: Tue Aug 25 10:05:20 +08 2026
;; MSG SIZE rcvd: 99
rolandhuu@ ~ 10:05:20
❯ dig :3456:7890:1::20 hp.com
; <<>> DiG 9.18.50 <<>> u/fd12:3456:7890:1::20 hp.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 62952
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 22 (No Reachable Authority): (No valid response from name servers for hp.com. A IN)
; EDE: 13 (Cached Error): (hp.com. A IN)
; EDE: 3 (Stale Answer): (hp.com A IN)
;; QUESTION SECTION:
;hp.com. IN A
;; Query time: 200 msec
;; SERVER: fd12:3456:7890:1::20#53(fd12:3456:7890:1::20) (UDP)
;; WHEN: Tue Aug 25 10:05:23 +08 2026
;; MSG SIZE rcvd: 128:3456:7890:1::20 hp.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 62952
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; EDE: 22 (No Reachable Authority): (No valid response from name servers for hp.com. A IN)
; EDE: 13 (Cached Error): (hp.com. A IN)
; EDE: 3 (Stale Answer): (hp.com A IN)
;; QUESTION SECTION:
;hp.com. IN A
;; Query time: 200 msec
;; SERVER: fd12:3456:7890:1::20#53(fd12:3456:7890:1::20) (UDP)
;; WHEN: Tue Aug 25 10:05:23 +08 2026
;; MSG SIZE rcvd: 128
1
u/shreyasonline 8d ago
Thanks for the details. I would recommend that you use the DNS Client tool that is built-in to the DNS admin panel. Select the same forwarder as the server and the same protocol and then do the test. The DNS Client tool on the panel works independent of the DNS server and will query the specified server independently.
The second thing you can do is to check for error logs in Logs > View Logs section on the panel. Do test with DNS Client tool where you select the server as This Server and then check the logs to find the errors being generated. These error logs will help to understand the root cause.
If you need help with understanding these errors then do post a few of them here.
I am assuming that the forwarder configuration has IPv6 address included in round brackets. If the forwarder config has only the domain name then that DNS server will have to do recursive resolution to resolve it first before being able to forward any requests to the upstream.
1
u/SnooOranges6925 7d ago
silly me.. not sure how to attach log file to reply..
TestResult
Quad9 DoH over IPv4 (
9.9.9.9)✅ Works, 23msQuad9 DoT over IPv4 (
9.9.9.9)✅ Works, 45ms (A), 220ms (AAAA)Quad9 DoT over IPv6 (
[2620:fe::fe])❌ Timed outCloudflare DoT over IPv4 (
1.1.1.1)✅ Works, 117msCloudflare DoT over IPv6 (
[2606:4700:4700::1111])❌ Timed out2
u/shreyasonline 7d ago
You can send the log file by email to support@technitium.com. Or, just copy paste a few error logs you see in there.
From the test results, it looks like there is some issue with IPv6 connectivity or some kind of middle box blocking outbound TCP port 853 over IPv6.
1
1
u/Apachez 8d ago
Technitium is a resolver on its own - why do you use forwarders to begin with?