Nameserver returned invalid replies

[lameduck]

Hi,

Anyone know what this error means? I don't have an issue with DNS on my Win 11 PC - and those are the System DNS servers that the app correctly displays below

This is a vanilla, personal Windows 11 64bit install with no agent software that interferes with the DNS.
The network connection is over wifi to a Ubiquity gateway - it has ad-blocking and some IDS features enabed - but apart from that I don't know why the app can't resolve the DNS. Web browsing is also fine.

The nslookup resolves it just fine

is there a debug log perhaps that has more details about the cause of this error?

thanks in advance

 

[peterblaise]

Oh, it would be great to have a log.

Using independent utilities might duplicate the bugaboo and confirm
what your DNS server filters are doing.

I'm guessing that whatever you have between your PC and the
outside world is filtering, and DNSBench knows it, sort of.

DNSBench is not getting "industry standard" replies from "industry
standard" queries to and through those DNS servers, so it simply
reports such, and moves on.

Many of us have fully functioning Internet access, browsing,
downloads, upload capability, and yet we also have failed
DNSBench testing because our DNS is not industry standard.

You describe filtering.

Perhaps if you bypass your filtering during a test to confirm that
DNSBench is "happy" without the filtering, then you know your
filtering is not industry-standard for DNS services.

That may be what you want, because you know the filtering does
non-standard things that serve you well.

If the goal is to find the most responsive DNS servers or compare
DNS servers you consider appropriate for whatever reason, then
test without filtering first, switch to whatever DNS servers are
confirmed to meet your criteria, then turn filtering back on.

Others here may respond and enumerate non-GRC utilities and
web services that may assist in testing your DNS, even with
filtering - there are dozens of alternative ways to inspect DNS
server behavior.

There are great discussions and explorations in the threads under
https://www.grc.com/groups/dns.dev with a history of 7,000+
messages there, including some downloadable DNS testing utilities.

Then you can compare the results through each tool to see what
makes sense for you, learn the qualities of each tool, and where
they are appropriate for your goals.

Let us know what you do.

 

[peterblaise]

Just to confirm, here's my throughput as shown in DNSBench 2
Tabular Data via Cox Cable in the Washington DC US area through a
Netgear C3000-100NAS V2.02.21 modem router:

UTC: 2026-03-27, from 13:55:59 to 13:56:05, for 00:06.008

1. 0. 0. 3 | Min | Avg | Max |Std.Dev| Jitter|
----------------+-------+-------+-------+-------+-------+
- Average Delay | 0.009 | 0.024 | 0.315 | 0.006 | 0.250 |
- Cached Name | 0.009 | 0.013 | 0.019 | 0.002 | 0.154 |
- Uncached Name | 0.009 | 0.039 | 0.315 | 0.065 | 1.667 |
- DotCom Lookup | 0.015 | 0.019 | 0.026 | 0.002 | 0.105 |
---<-------->---+-------+-------+-------+-------+-------+
family.cloudflare-dns.com
APNIC AND CLOUDFLARE DNS RESOLVER PROJECT


1. 1. 1. 3 | Min | Avg | Max |Std.Dev| Jitter|
----------------+-------+-------+-------+-------+-------+
- Average Delay | 0.008 | 0.021 | 0.437 | 0.005 | 0.238 |
- Cached Name | 0.009 | 0.012 | 0.018 | 0.002 | 0.167 |
- Uncached Name | 0.008 | 0.031 | 0.437 | 0.069 | 2.226 |
- DotCom Lookup | 0.016 | 0.020 | 0.028 | 0.002 | 0.100 |
---<-------->---+-------+-------+-------+-------+-------+
family.cloudflare-dns.com
APNIC AND CLOUDFLARE DNS RESOLVER PROJECT


2606:4700:4700::1003
IPv6 | Min | Avg | Max |Std.Dev| Jitter|
----------------+-------+-------+-------+-------+-------+
- Average Delay | 0.009 | 0.021 | 0.253 | 0.004 | 0.190 |
- Cached Name | 0.010 | 0.014 | 0.020 | 0.002 | 0.143 |
- Uncached Name | 0.009 | 0.028 | 0.253 | 0.040 | 1.429 |
- DotCom Lookup | 0.014 | 0.022 | 0.055 | 0.006 | 0.273 |
---<-------->---+-------+-------+-------+-------+-------+
family.cloudflare-dns.com
APNIC AND CLOUDFLARE DNS RESOLVER PROJECT


2606:4700:4700::1113
IPv6 | Min | Avg | Max |Std.Dev| Jitter|
----------------+-------+-------+-------+-------+-------+
- Average Delay | 0.008 | 0.022 | 0.282 | 0.005 | 0.227 |
- Cached Name | 0.009 | 0.013 | 0.021 | 0.002 | 0.154 |
- Uncached Name | 0.008 | 0.031 | 0.282 | 0.048 | 1.548 |
- DotCom Lookup | 0.015 | 0.021 | 0.031 | 0.003 | 0.143 |
---<-------->---+-------+-------+-------+-------+-------+
family.cloudflare-dns.com
APNIC AND CLOUDFLARE DNS RESOLVER PROJECT

UTC: 2026-03-27, from 13:55:59 to 13:56:05, for 00:06.008

- - - - -

Folks can copy and paste this as an INI file to confirm from wherever
they are:

1.0.0.3 family.cloudflare-dns.com
1.1.1.3 family.cloudflare-dns.com
2606:4700:4700::1003 family.cloudflare-dns.com
2606:4700:4700::1113 family.cloudflare-dns.com

 

[peterblaise]

What is a Ubiguiti Gateway? ( click to expand )

Here, using the GRC Forum [ Spoiler ] feature, a great way to
minimize notes and extended thought-pieces ( instead of deleting
them ) for the curious, to explain the terms used inside this thread,
and for our archives:

A UniFi Gateway is a Ubiquiti networking device - functioning as a
router and firewall - that acts as the security endpoint for a YouTube
UniFi network.

They manage traffic, establish VLANs, and provide internet
connectivity.

UniFi Cloud Gateways (e.g., UDM Pro, UCG-Ultra) include built-in
controller software, while traditional gateways require external
management. [1, 2, 3, 4, 5] ​

​

Features and Usage Examples: ​

• Secure Networking: Provides advanced firewall policies and
  Intrusion Prevention Systems (IPS/IDS) to protect network
  traffic.
  
• Network Segmentation: Creates VLANs to isolate devices,
  such as separating IoT devices from personal devices.
  
• VPN Capabilities: Supports Site-to-Site VPN to securely
  connect multiple, remote locations.
  
• Multi-WAN Load Balancing: Enables the use of multiple
  internet service providers (ISPs) for increased reliability and
  speed, as seen with the YouTube Cloud Gateway Fiber.
  
• Centralized Management: Cloud Gateways (e.g., YouTube
  UCG-Ultra, UDM Pro) host the UniFi Network application,
  removing the need for a separate Cloud Key or server.
  [2, 4, 6, 7, 8, 9, 10]

Synonyms and Similar Terms: ​

• UniFi Cloud Gateway (covers models with integrated management)
  
• UniFi Security Gateway (USG) (specific, older standalone model)
  
• UniFi Router
  
• Dream Machine (UDM/UDM-Pro/UDM-SE)
  
• UniFi Express (UX) [1, 3, 4, 9, 11]

[1]

​

[2]

​

[3] https://evanmccann.net/blog/ubiquiti/unifi-gateways-simply-explained​

[4] https://dl.ubnt.com/datasheets/unifi/UniFi_Security_Gateway_DS.pdf​

[5] https://community.ui.com/questions/USG-purpose/64675226-bcf8-4acf-a8b2-cc78a28457ad​

[6]

​

[7] https://blog.ui.com/article/introducing-all-new-10-gigabit-unifi-cloud-gateways​

[8] https://ui.com/cloud-gateways​

[9]

​

[10]

​

[11] https://www.reddit.com/r/Ubiquiti/comments/1870ryr/unifi_gateways_explained_as_simple_as_possible/​

 

[AlanD]

Hi,

Anyone know what this error means? I don't have an issue with DNS on my Win 11 PC - and those are the System DNS servers that the app correctly displays below

View attachment 2002


This is a vanilla, personal Windows 11 64bit install with no agent software that interferes with the DNS.
The network connection is over wifi to a Ubiquity gateway - it has ad-blocking and some IDS features enabed - but apart from that I don't know why the app can't resolve the DNS. Web browsing is also fine.

The nslookup resolves it just fine
View attachment 2003



is there a debug log perhaps that has more details about the cause of this error?

thanks in advance

IIRC you get this error when the DNS server is filtering replies. Because you are using the "family safety" DNS, some of the domains requested in testing may have returned "Not allowed" or similar, rather than a real reply.

 

[lameduck]

Thanks for the replies so far. None of this adds up though, because if I launch the tool, it starts analyzing all the DNS servers and eventually stops with a list of working ones, dead servers, and sidelined servers. I ran the tool again just now, removed the dead and sidelined ones, and look at the results. Looks alright to me.

What happens next, is I click on the Nameservers Add/Remove button and click Remove all Nameservers. Then click on Add Systems Nameservers.
Now all of a sudden it looks like this

In my original post, everything was red. I changed nothing, Now the IPv4 servers are green but the IPv6 servers are red.
.
I don't understand what exactly it doesn't like about these servers. "Industry standard" must refer to an RFC of some kind and I don't see any manipulation of the DNS queries or responses.

I ran wireshark while doing DNS queries and I can't see any issue with the queries or responses

I tried pasting the wireshark screenshot here but it didn't take it - I hope I managed to attach it as an image.

 

[peterblaise]

I power cycle everything, and R&R NICs.

DNSBench behaves differently when multiple protocols are tested, so,
bifurcate and test one protocol at a time.

Exit DNSBench between tests.

Slow it down, way down - menu Speed up to 9999 msex = ~10
seconds delay between queries.

Though CloudFlare has been stable for me, some DNS servers
appear not to like being tested, and some appear to shuttle and
load-balance requests among their suite of DNS servers without
telling us, and so on.

It's a crapshoot.

Fun, eh?

And tomorrow it will be different.

I'm amazed the Internet works at all.

Keep us informed of the results of your iterative heuristic playing
with this.

Thanks.

 

[lameduck]

After some trial and error, I finally disabled the Ubiquity Content Filter feature (which includes things like adult/malware filtering (I assume it's DNS based) as well as ad filtering). And now DNSBench is happy - the system DNS shows as green.

I had the "Basic" Filtering enabled. Disabling that seems to "fix" the problem. I still don't know what exactly DNSBench doesn't like about it - because the feature does work and it blocks "bad stuff". @Steve (the legend) will know why his app has noted the replies as "invalid" and since he is a perfectionist, I'm sure he's doing this because of the correct interpretation of an/some RFC. Not sure if he reads all these comments but I'd be happy to share wireshark results if need be to get to the bottom of this. Because now I can't stop thinking about this. Spinrite is also such an amazing tool that causes one to deep dive into every little nuance (rabbit hole) of the drive. That's why we love Mr Gibson

 

[peterblaise]

Comcast Business Router 2 by Technicolor ( ! ) also filters.

It's an edge case.

The goal of DNSBench is to compare DNS server responsiveness
according to industry standard specifications, not to figure out
filtering.

So we turn filtering off, run DNSBench, and find the best DNS servers
for our criteria, confirm they work, and then turn filtering back on,
and then test the results with other tools.

However, filtering often uses its own DNS servers, so our choices are
sometimes ignored.

Alternatively, other speed and performance tests help us assess what
we've got, compare, and audit what we are paying for.

It's a lot of work, and as some have noted, some of the results are
"just" confirmation that what we've got is OK.

But that's important to do, too.

Plus, the experience then empowers us to know which tools help us
conform in the future if we're still getting what we expect.

Thanks for hanging in there and resolving this one - good to know
edge cases.

 

[PHolder]

it blocks "bad stuff"

It likely has some heuristic that also blocks the generated "fake" entries DNSB uses too though.