Selective HTTPS sites time out over Wi‑Fi after enabling DNSSEC validation on home resolver

Environment

Home network: consumer ISP, Ubiquiti EdgeRouter X running Unbound as local recursive resolver with DNSSEC enabled, mixed client set: Windows 10, macOS 12, Android 13 phones on 2.4 GHz and 5 GHz Wi‑Fi.

Symptoms

From several Wi‑Fi clients, specific HTTPS sites (banking and some CDNs) intermittently fail to load and show browser timeout or 'server not found' errors, while other HTTPS sites load normally. Wired desktop on same LAN is unaffected. Issue started immediately after enabling DNSSEC validation in Unbound.

Observations

Unbound logs show repeated SERVFAIL for queries to certain authoritative servers or when validating DNSSEC chain; tcpdump on router shows retries to upstream authoritative servers and occasional truncated UDP responses forcing DNS over TCP. Clients on wired port use same resolver but do not see timeouts—wired queries succeed faster. Rebooting router temporarily reduces failures for a few minutes. ISP-provided DNS (when used) resolves the same sites without issue.

Already attempted

Disabled DNSSEC again (Unbound config) — client site access immediately returned to normal. Flushed caches on Unbound and client OS DNS caches. Switched Unbound to forward to ISP DNS over port 53 — symptoms stopped. Tried toggling EDNS buffer sizes and enabling TCP-only to authoritative servers with no durable improvement.

Question

What diagnostics and configuration changes are safe to apply to Unbound/EdgeRouter to keep DNSSEC validation enabled while avoiding selective HTTPS timeouts on Wi‑Fi clients? How to determine whether the root cause is upstream authoritative servers, MTU/EDNS issues, or client resolver behavior?

Post timeline

COMMUNITY RESPONSES

Verified community troubleshooting

0 replies

No answers yet..

Showing 0 of 0 community responses

AI DIAGNOSTICS

Incident analysis

Updated 1w ago• Trouble ID

Most likely causes

Authoritative DNS servers returning large DNSSEC-signed responses that get fragmented/truncated on the Wi‑Fi path (EDNS/MTU issue) causing timeouts. 85%

EdgeRouter's firewall/NAT or MTU settings blocking or mishandling DNS over TCP or fragmented DNS responses from authoritative servers. 75%

Upstream authoritative servers returning inconsistent DNSSEC signatures or non-compliant responses that Unbound marks SERVFAIL while ISP resolver masks the issue. 60%

Summary

Symptoms align with DNSSEC validation introducing additional response size/validation steps that expose issues in the path: truncated UDP requiring TCP, EDNS/MTU mismatches, or upstream authoritative servers intermittently failing validation. The fact wired clients succeed while Wi‑Fi clients experience timeouts suggests timing or packet-loss sensitivity (Wi‑Fi retransmits/latency), or different resolver behavior (some clients may fall back earlier or use cached responses). Disabling DNSSEC fixed the issue, indicating validation pathology rather than application-level TLS.

Suggested Fixes

Diagnostic step 1

Re-enable DNSSEC only after reversible diagnostics: enable verbose Unbound query logging for affected domains and collect full query/response logs (avoid sharing private data).

Diagnostic step 2

On the router, capture packets (tcpdump) for a failing query from a Wi‑Fi client to the authoritative server IP; examine for DNS truncation (TC bit), fragmentation, or TCP fallback failures.

Diagnostic step 3

Temporarily reduce EDNS buffer size in Unbound (e.g., edns-buffer-size 1232) to avoid fragmentation and verify if the problem disappears; this is reversible.