1
Diagnostic step 1
Re-enable DNSSEC only after reversible diagnostics: enable verbose Unbound query logging for affected domains and collect full query/response logs (avoid sharing private data).
FULL AI ANALYSIS
Selective HTTPS sites time out over Wi‑Fi after enabling DNSSEC validation on home resolver
Generated Oct 3, 2026, 12:35:03 AM
Analysis summary
Symptoms align with DNSSEC validation introducing additional response size/validation steps that expose issues in the path: truncated UDP requiring TCP, EDNS/MTU mismatches, or upstream authoritative servers intermittently failing validation. The fact wired clients succeed while Wi‑Fi clients experience timeouts suggests timing or packet-loss sensitivity (Wi‑Fi retransmits/latency), or different resolver behavior (some clients may fall back earlier or use cached responses). Disabling DNSSEC fixed the issue, indicating validation pathology rather than application-level TLS.
Possible causes
Authoritative DNS servers returning large DNSSEC-signed responses that get fragmented/truncated on the Wi‑Fi path (EDNS/MTU issue) causing timeouts.
85%EdgeRouter's firewall/NAT or MTU settings blocking or mishandling DNS over TCP or fragmented DNS responses from authoritative servers.
75%Upstream authoritative servers returning inconsistent DNSSEC signatures or non-compliant responses that Unbound marks SERVFAIL while ISP resolver masks the issue.
60%Intermittent packet loss/latency on the Wi‑Fi radio causing DNS TCP fallback to fail or time out during validation.
40%Suggested fixes
2
Diagnostic step 2
On the router, capture packets (tcpdump) for a failing query from a Wi‑Fi client to the authoritative server IP; examine for DNS truncation (TC bit), fragmentation, or TCP fallback failures.
3
Diagnostic step 3
Temporarily reduce EDNS buffer size in Unbound (e.g., edns-buffer-size 1232) to avoid fragmentation and verify if the problem disappears; this is reversible.
4
Diagnostic step 4
Test forcing Unbound to use TCP for queries to the specific authoritative servers to see whether TCP resolves the SERVFAILs (set forward-zone for those servers temporarily).
5
Diagnostic step 5
Check and compare MTU settings on Wi‑Fi AP, router WAN, and any ISP modem; test increasing/decreasing MTU on LAN/Wi‑Fi as a reversible trial (document original values). If fragmentation is observed, adjust PMTU settings or MSS clamping on the router firewall for TCP paths as a mitigation (reversible).