Weird behavior iOS 17 - HTTPS Query

[larivierec]

Hey, me again with the weird questions :)

So some weird behavior has been going down since the latest iOS update, it's as though local dns requests automatically go to https.

here's the configuration for reference

1. blocky configuration: https://github.com/larivierec/home-cluster/blob/main/kubernetes/apps/networking/blocky/app/config/config.yml

When I send a request to blocky, it forwards it to k8s-gateway which is basically the internal resolver, it usually will respond with ip addresses to my ingress controllers either 192.168.50.2/3 or services of type "Load Balancer".

The weird thing is that now, when I send a request to a local domain for example.tld.com -> blocky -> forwarded to k8s-gateway with CONDITIONAL rule and then the page fails to load.

Here are some logs

[2023-10-06 14:30:48]  INFO queryLog: query resolved answer=A (192.168.50.2) client_ip=192.168.10.6 client_names=192.168.10.6 duration_ms=1 hostname=blocky-7dbbb5b8d7-d697g question_name=radarr.<redacted>. question_type=A response_code=NOERROR response_reason=CONDITIONAL response_type=CONDITIONAL

[2023-10-06 14:30:48]  INFO queryLog: query resolved answer= client_ip=192.168.10.6 client_names=192.168.10.6 duration_ms=1 hostname=blocky-7dbbb5b8d7-d697g question_name=radarr.<redacted>. question_type=HTTPS response_code=NOERROR response_reason=CONDITIONAL response_type=CONDITIONAL

On k8s-gateway side, it seems i get 2 requests for this.

[INFO] 10.42.3.248:38855 - 47443 "A IN radarr.<redacted>. udp 33 false 512" NOERROR qr,aa,rd 64 0.000246835s
[INFO] 10.42.3.248:59572 - 45328 "HTTPS IN radarr.<redacted>. udp 33 false 512" NOERROR qr,aa,rd 150 0.000663252s

and i think iOS is reading the HTTPS one and ultimately fails because the answers from HTTPS was empty.

Here is the configuration for k8s-gateway if you'd like (i don't expect you to debug it's essentially Coredns for reference): https://github.com/larivierec/home-cluster/blob/main/kubernetes/apps/networking/k8s-gateway/app/config/Corefile

Is there something i'm doing wrong?

[kwitsch]

It's something iOS specific.
It should fallback to A if HTTPS isn't resolved.
You could filter HTTPS requests in blocky to enforce this.

[larivierec]

I'll try that out, however, shouldn't the https response from coredns contain a response?

I tried looking to see if you can log the return from coredns doesn't seem possible 🤦‍♂️

It is returning an empty answer read by blocky with no error

[kwitsch]

As long as you don't intend to actively use them it's far easier to just block them.
If I remember correctly iOS use them to prevent DNS rewrites which you most likely actively do if you use blocky. 🤔

Sorry if I'm wrong.
There are no Apple devices in my multiple networks at all. 😅

[larivierec]

Thanks for your answers btw turns out the k8s_gateway plugin for coredns does not answer queries other than A/AAAA/NS/SOA.

What I ended up doing is force dns servers locally to use DoH using a iOS DNS profile and it started to work. For some odd reason the standard queries coming in on port 53 were the ones that weren't working.

What is a major bummer, I needed an app to be able to add the profile I would've expected it to be native.

[ThinkChaos]

I don't have anything really specific to add related to the issue, but just wrote down some info that might be useful for anyone looking at this :)

I agree it sucks iOS you can't configure non plaintext DNS servers easily on iOS. If you have a mac you can use "Configurator" to create a profile as you said. I know profiles are just XML files so even without a mac you can write one (there's some examples on Github I think), but I'm not sure iOS will accept to install an unsigned profile.
Anyways the profile is the only way to setup DoH on iOS AFAIK, and I don't think it supports DoT.

Once you have a profile you can also use it to setup other repetitive stuff, like email accounts and various settings which is nice. And if you make your iOS device "enrolled" (a thing for companies usually) you get even more power, though that must be done during initial device setup, so you might need to erase the device and can't restore from backup (since that re-erases).

For my setup, I have a split tunnel wireguard VPN that I always keep on, and DoH goes through that so I get my custom DNS everywhere I go.