dig @127.0.0.1 fails with communication error -> timeout

[nepixl]

Hello,

a colleague asks me, why he can't access dpd.com so I've to check that. (Its a company network; running latest AGH v0.107.67 on an Ubuntu VM (no docker!))

On my mobilephone without access to AGH this page load fine.

If I request this page on our companynetwork, it runs into timeout.

Now I've tried dig it from the AGH Server:

I want to ask if this normal:

 dig @127.0.0.1 dpd.com (same with google.com)
;; communications error to 127.0.0.1#53: timed out
;; communications error to 127.0.0.1#53: timed out
;; communications error to 127.0.0.1#53: timed out

Via TCP it is working (not?):

dig @127.0.0.1 google.com +tcp

; <<>> DiG 9.18.30-0ubuntu0.24.04.2-Ubuntu <<>> @127.0.0.1 google.com +tcp
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 8859
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;google.com.                    IN      A

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (TCP)
;; WHEN: Wed Oct 08 12:42:59 UTC 2025
;; MSG SIZE  rcvd: 28

tcp seem to work:

nc -vz 127.0.0.1 53
Connection to 127.0.0.1 53 port [tcp/domain] succeeded!

Netstat tells me, it binded only v6?

netstat -tulpn | grep 53
tcp6       0      0 :::53                   :::*                    LISTEN      3719/AdGuardHome
tcp6       0      0 :::53                   :::*                    LISTEN      3719/AdGuardHome
udp6       0      0 :::53                   :::*                                3719/AdGuardHome
udp6       0      0 :::53                   :::*                                3719/AdGuardHome

AdGuardHome.yaml:

  bind_hosts:
    - 0.0.0.0
    - '::'
  port: 53

upstream_dns:
    - [/domain.tld/]192.168.20.14 192.168.20.5 192.168.4.252
    - '# CloudFlare'
    - https://dns.cloudflare.com/dns-query
    - tls://1.1.1.1
    - '# Quad9 Servers'
    - https://dns.quad9.net/dns-query
    - tls://dns.quad9.net
    - https://dns11.quad9.net/dns-query
    - tls://dns11.quad9.net
  upstream_dns_file: ""

./AdGuardHome --check-config
2025/10/08 13:00:05.359113 [info] AdGuard Home, version v0.107.67
2025/10/08 13:00:05.360873 [info] configuration file is ok

Firewall is off.

I've already downgraded to v0.107.65 but same result.

so my question: is this normal/expected behaviour?

Logs doesnt give any good information (for me at least).

Tell me if you need more data.

Thank you,
regards,
pixl

[schzhn]

Just some ideas.

Make sure plain DNS is enabled.
Set dns.serve_plain_dns: true in the configuration file, or in the Web UI ensure Enable plain DNS is on.
Also review dns.disallowed_clients.

Bind only to IPv6.

dns:
  bind_hosts:
    - '::'

This can be enough if sysctl net.ipv6.bindv6only is 0 (Linux default), where a single IPv6 socket also accepts IPv4.

If that doesn’t work, try IPv4 only.

dns:
  bind_hosts:
    - 0.0.0.0

[nepixl]

[nepixl]

Im just stupid and found my brainerror:

allowed_clients:
    - 192.168.20.14
    - 192.168.20.5
    - 192.168.4.252
    - 127.0.0.1

I had to add loopback address in allowed_clients (which makes totally sense ...), now I can dig everything.

Sorry! Maybe this will help others in future.

Thank you @schzhn for pushing me into the right direction (disallowed clients).

Appreciate that.
pixl