How one can diagnose why rdns frequently drops to fallback DNS?

[onetimecontributor]

Hi! v0.5.5t, I observe unexpectedly high (more than 3/4 subjectively) amount of queries resolved by fallback DNS (coming from non-bypassed apps).
My config is as follows:

• WG in advanced
• DNS is set to Other DNS (nextDNS DoT)
• split DNS OFF
• never proxy DNS OFF
• prevent DNS leaks ON
• use fallback DNS as bypass ON
• fallback DNS is set to Rethink
• use system for undelegated OFF (not relevant)
• on-device blockslists (not relevant)
• loopback OFF

Apart from negative impact of nextDNS not applying my custom rules, it also increases load/costs on rethinkdns infra.

How can I diagnose the reason for such a behavior? What to look for in logs? On a screenshots I have sample logs for both falled back and expected behaviors when I try to run DNS leak tests on Surfshark web page (DNS resolved as expected via upstream) and on Mullvad web page (falling back to rethinkdns).

upstream nexdns

fallback

[ignoramous]

The use of Configure -> Network -> Fallback DNS (which is really "Bootstrap DNS" used by Rethink itself) was not fully, totally, properly reported in versions prior to v055o, especially when Configure -> Network -> Loopback was also turned OFF.

Frequent use of Fallback DNS is normal iff:

1. It is the Rethink app itself using it. v055o onwards, on Android 12+ devices, Configure -> Logs -> DNS should also accurately show app names against each, individual DNS queries.
2. DNSCrypt is the user-preferred upstream, which is then "failing" (to connect over a DNSCrypt Relay, or to refresh its "certificate" which must succeed once every 20h).

[ignoramous]

In DoT's case, I am not sure why Rethink would use "Fallback DNS" in its stead that often.

The only way to get to the bottom of this is through logs. If you're technical enough:

# switch Rethink's log level to Very Verbose

Configure -> Settings -> Log level -> Very Verbose


# increase adb logs buffer to 16mb.
# the default is 256kb, which isn't enough.
# note: Android switches to the default after reboots.

adb logcat -G 16m


# and then, when you spot fallback being used,
# and the timeline was within the past 2 hours,
# capture the log output 

adb logcat > /path/to/file


# zip the file and email it to me, mz at celzero dot com
# do link this discussion in the email subject / body
# along with a screenshot from Configure -> Logs -> DNS
# showing "Fallback DNS" being used for other apps
# instead of NextDNS DNS-over-TLS 
# or: if a screenshot isn't possible, share the (local) timestamp
# of when "Fallback DNS" was used.

[onetimecontributor]

Will try, tnx. I was rather asking for a clue what to look for in the logs. Anyway, I'll try to review them myself with ai assistance. Tnx

[onetimecontributor]

on the 1st screenshot above, resolver 207.154.224.110 is nextdns, on the 2md 45.183.223.209 is a fallback

[ignoramous]

Gotcha. In v055v (soon), we try very hard to never have to "fallback" on some other DNS other than the ones user sets up.