DNS intermittently failing on all requests
Author: TerranceCreated Nov 11, 2025Updated Sep 14, 2026
Labelsbug
Pre-Submit Checklist:
- Check applicable sources for existing issues:
What happened:
At seemingly random intervals, DNS stops working for up to a minute, and non-cached requests appear to time out.
Having reduced config to a single known-working DNS server, the dashboard status changes to Insecure for a few seconds while playing up.
In the logs is a lot of this:
WRN er/resolve:467 > 992 resolver: query to dns://172.16.1.1:53#config failed: dial udp :63958->172.16.1.1:53: bind: An attempt was made to access a socket in a way forbidden by its access permissions.
What did you expect to happen?:
DNS to resolve domains as normal.
How did you reproduce it?:
No explicit actions.
Debug Information:
Version 2.0.25:
Portmaster 2.0.25
built with go1.24.7 (gc -cgo) for windows/amd64
at 2025-09-05T09:10:26Z
commit a66544959c689599ab118b34ffd94ea261aa86c9 (clean)
at 2025-09-05T08:17:28Z
from https://github.com/safing/portmaster.git
Licensed under the GPLv3 license.Platform: Microsoft Windows 10 Pro 10.0.19045 Build 19045:
System: Microsoft Windows 10 Pro windows (Standalone Workstation) 10.0.19045 Build 19045
Kernel: 10.0.19045 Build 19045 x86_64
Unexpected Logs:
2025-11-11 22:07:10.035 WRN er/resolve:467 > 992 resolver: query to dns://172.16.1.1:53#config failed: dial udp :63958->172.16.1.1:53: bind: An attempt was made to access a socket in a way forbidden by its access permissions.
2025-11-11 22:07:10.035 WRN er/resolve:317 > 995 resolver: async query for 1.example.com.A failed: all 1 query-compliant resolvers failed, last error: dial udp :63958->172.16.1.1:53: bind: An attempt was made to access a socket in a way forbidden by its access permissions.
2025-11-11 22:07:10.425 WRN er/resolve:467 > 090 resolver: query to dns://172.16.1.1:53#config failed: dial udp :63145->172.16.1.1:53: bind: An attempt was made to access a socket in a way forbidden by its access permissions.
2025-11-11 22:07:10.425 WRN er/resolve:317 > 092 resolver: async query for 2.example.com.AAAA failed: all 1 query-compliant resolvers failed, last error: dial udp :63145->172.16.1.1:53: bind: An attempt was made to access a socket in a way forbidden by its access permissions.
2025-11-11 22:07:25.940 WRN er/resolve:467 > 369 resolver: query to dns://172.16.1.1:53#config failed: dial udp :56993->172.16.1.1:53: bind: An attempt was made to access a socket in a way forbidden by its access permissions.
2025-11-11 22:07:25.940 WRN nameserver:296 > 371 nameserver: failed to resolve 3.example.com.A: all 1 query-compliant resolvers failed, last error: dial udp :56993->172.16.1.1:53: bind: An attempt was made to access a socket in a way forbidden by its access permissions.
2025-11-11 22:07:26.566 WRN er/resolve:317 > 380 resolver: async query for 4.example.com.A failed: all 1 query-compliant resolvers failed, last error: record could not be found
2025-11-11 22:07:26.577 WRN er/resolve:317 > 385 resolver: async query for 4.example.com.AAAA failed: all 1 query-compliant resolvers failed, last error: record could not be found
2025-11-11 22:07:29.393 WRN er/resolve:317 > 406 resolver: async query for 4.example.com.A failed: all 1 query-compliant resolvers failed, last error: record could not be found
2025-11-11 22:07:29.393 WRN er/resolve:317 > 409 resolver: async query for 4.example.com.AAAA failed: all 1 query-compliant resolvers failed, last error: record could not be found
251111 22:07:38.183 CURRENT TIMEStatus: Online:
OnlineStatus: Online
CaptivePortal: SPN: disabled (module disabled):
HomeHubID:
HomeHubName:
HomeHubIP:
Transport:
---
Client: true
PublicHub: false
HubHasIPv4: false
HubHasIPv6: falseResolvers: 4/4:
Apoc (dns://172.16.1.1:53#config)
dns://172.16.1.1:53#config
Failing: false
fe80::32b1:b5ff:fe91:3659 (dns://fe80::32b1:b5ff:fe91:3659:53#system)
dns://fe80::32b1:b5ff:fe91:3659:53#system
Search Domains: .home., .home.
Failing: false
172.16.1.1 (dns://172.16.1.1:53#system)
dns://172.16.1.1:53#system
Search Domains: .home., .home.
Failing: false
172.16.0.1 (dns://172.16.0.1:53#system)
dns://172.16.0.1:53#system
Search Domains: .home., .home.
Failing: falseConfig: 11:
core/automaticUpdates: false
core/devMode: true
core/expertiseLevel: developer
dns/nameserverRetryRate: 10
dns/nameservers: [redacted]
dns/noAssignedNameservers: true
dns/useStaleCache: true
filter/askTimeout: 10
filter/defaultAction: ask
filter/endpoints: [redacted]
filter/removeOutOfScopeDNS: falseUpdates: stable (17):
Binaries Index: v2.0.25 from 2025-11-08 19:02:50.4022513 +0000 GMT m=+0.072386501
Intel Index: v20250930.11.57 from 2025-09-30 11:57:09.918621973 +0000 UTC
File Version Index SHA256
WebView2Loader.dll 2.0.25 binaries 609c974a8cdd6a76a745b3d81b62f321d79f2dc8f4929e1eea8469d9d78baf79
assets.zip 2.0.25 binaries 8068115b8d9e5c2059032befc22226578d0b7e676f776dab553c692497878752
portmaster-core.dll 2.0.25 binaries 3e5db91a4c48278b6ab7355633306685011edc8c59eadd8c760c499a79f50254
portmaster-core.exe 2.0.25 binaries 341f8bed55657366c3271b6dc369b091fb24a39a445aa7795db3c90810c5a57a
portmaster-kext.sys 2.0.25 binaries 4d72a8b43a4a3f2e2b5598edbd64a28de8c47a4db546607164c5e48c07103329
portmaster.exe 2.0.25 binaries ed9afffe733992c49ad3e75c5b263c2e0dd5231e600e7bb01c40373b27b1c4f5
portmaster.zip 2.0.25 binaries 0011176f80ba498a87a86ba782bdf7896f3e0289debb53e05b071a177ee96b23
uninstall.exe 2.0.25 binaries d8c55b2c667beef02d1cf039258af12f25bd9bd407af841609d0d1e686affb81
main-intel.yaml 20250930.11.57 intel c73be8f0600af4500f5d3e6f8e354f5d96dba2ce37d59aa976306a8ea9e5bc6d
notifications.yaml 20250915.11.11 intel 8168f64860717712a9d0a00da876e84f03c34834b3a8e0e1dfa783a9c29f7235
news.yaml 20250812.8.58 intel fa64e8d0f2adc61093df516d4be68ad536c4de29fd9f7c2473311dbdaaa1f9c6
index.dsd 2025.4.14 intel 026325cc7af459251fb08dce0a6166aeece4c9b5a4b7d26e15f4f7d94e0e6e0e
base.dsdl 20250901.0.0 intel e094359579742a66d61761fc57cb6e97a4ef18dfa632e692b9d41fbc0578ff60
intermediate.dsdl 20250831.0.0 intel fe97067ec790deaf6ac7f911c3c771eb024e2fa75e3d0ad6099e3698a372b9f8
urgent.dsdl 20250831.21.0 intel fbaacbee9e500ba61450fb5f242c2be52130f32b3dab10271dfb2af45e9db1bf
geoipv4.mmdb 20250623.0.0 intel 1157da35a7c3d791853032f998b60bb778b700a37716150f18619c85196fe5ce
geoipv6.mmdb 20250623.0.0 intel 0fa07fada19f38c9e01925a3682d0d5abaa8298e22203ac43d04ffc1e553dfc9Compatibility: WFP State (38):
Edge traversal Teredo Authorization Sublayer SubLayer Edge traversal Teredo Authorization Sublayer {7b6b11f6-cbb5-433c-ae06-6a4f0076e49e}
IPxlat Forward IPv4 filter Callout Filters forwarded IPv4 packets into synthetic IPv6 packets {b255c296-7e0c-4115-95f3-b7f24a8a1162} [no provider key] FWPM_LAYER_IPFORWARD_V4
IPxlat Forward IPv4 sub layer SubLayer Sub layer for filtering forwarded IPv4 packets into synthetic IPv6 packets {4351e497-5d8b-46bc-86d9-abccdb868d6d}
IPxlat Inbound IPv6 filter Callout Filters incoming IPv6 packets into synthetic IPv4 packets {93bb703d-0502-42e2-8e30-a14576e5085d} [no provider key] FWPM_LAYER_INBOUND_IPPACKET_V6
IPxlat Inbound IPv6 sub layer SubLayer Sub layer for filtering incoming IPv6 packets into synthetic IPv4 packets {dfb035ca-c2a7-4684-97b6-4dbc57c63590}
IPxlat Outbound IPv4 filter Callout Filters outgoing IPv4 packets into synthetic IPv6 packets {66d52657-1979-4e58-b3f7-4756434c4880} [no provider key] FWPM_LAYER_OUTBOUND_IPPACKET_V4
IPxlat Outbound IPv4 sub layer SubLayer Sub layer for filtering outgoing IPv4 packets into synthetic IPv6 packets {d3e70856-fc90-4c0a-b9b2-a6f73e20b5cc}
Portmaster ALE Outbound IPv4 Callout Portmaster uses this layer to block/permit outgoing ipv4 connections {58545073-f893-454c-bbea-a57bc964f46d} [no provider key] FWPM_LAYER_ALE_AUTH_CONNECT_V4
Portmaster ALE Outbound IPv4 Filter Portmaster uses this layer to block/permit outgoing ipv4 connections {48b9a96e-3a13-4bf0-a786-0cc7e38ceb70} [no provider key] FWPM_LAYER_ALE_AUTH_CONNECT_V4 {7dab1057-8e2b-40c4-9b85-693e381d7896}
Portmaster ALE Outbound IPv6 Callout Portmaster uses this layer to block/permit outgoing ipv6 connections {4bd2a080-2585-478d-977c-7f340c6bc3d4} [no provider key] FWPM_LAYER_ALE_AUTH_CONNECT_V6
Portmaster ALE Outbound IPv6 Filter Portmaster uses this layer to block/permit outgoing ipv6 connections {8255c9d3-ba4c-43e2-abb2-8a039a6fc6fb} [no provider key] FWPM_LAYER_ALE_AUTH_CONNECT_V6 {7dab1057-8e2b-40c4-9b85-693e381d7896}
Portmaster Datagram IPv4 Callout Portmaster uses this layer for bandwidth statistics of IPv4 UDP connections {e7eeeaba-168a-45bb-8747-e1a702feb2c5} [no provider key] FWPM_LAYER_DATAGRAM_DATA_V4
Portmaster Datagram IPv4 Filter Portmaster uses this layer for bandwidth statistics of IPv4 UDP connections {6b09e758-f859-4ce8-a116-3a40812566eb} [no provider key] FWPM_LAYER_DATAGRAM_DATA_V4 {7dab1057-8e2b-40c4-9b85-693e381d7896}
Portmaster Datagram IPv6 Callout Portmaster uses this layer for bandwidth statistics of IPv6 UDP connections {b25862cd-f744-4452-b14a-d0c1e5a25b30} [no provider key] FWPM_LAYER_DATAGRAM_DATA_V6
Portmaster Datagram IPv6 Filter Portmaster uses this layer for bandwidth statistics of IPv6 UDP connections {c87d4838-c14e-4e37-a86c-0c2abc95fbd0} [no provider key] FWPM_LAYER_DATAGRAM_DATA_V6 {7dab1057-8e2b-40c4-9b85-693e381d7896}
Portmaster Endpoint Closure IPv4 Callout Portmaster uses this layer to detect when a IPv4 connection has ended {58f02845-ace9-4455-ac80-8a84b86fe566} [no provider key] FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4
Portmaster Endpoint Closure IPv4 Filter Portmaster uses this layer to detect when a IPv4 connection has ended {9968c184-343b-4e4a-b69d-79db612e01a0} [no provider key] FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4 {7dab1057-8e2b-40c4-9b85-693e381d7896}
Portmaster Endpoint Closure IPv6 Callout Portmaster uses this layer to detect when a IPv6 connection has ended {2bc82359-9dc5-4315-9c93-c89467e283ce} [no provider key] FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V6
Portmaster Endpoint Closure IPv6 Filter Portmaster uses this layer to detect when a IPv6 connection has ended {ea063452-b06b-4e5c-8d4a-ba6cb0247695} [no provider key] FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V6 {7dab1057-8e2b-40c4-9b85-693e381d7896}
Portmaster Packet Inbound IPv4 Callout Portmaster uses this layer to redirect/block/permit inbound ipv4 packets {f0369374-203d-4bf0-83d2-b2ad3cc17a50} [no provider key] FWPM_LAYER_INBOUND_IPPACKET_V4
Portmaster Packet Inbound IPv4 Filter Portmaster uses this layer to redirect/block/permit inbound ipv4 packets {8a077199-db48-432e-944d-ec4792fc2cdf} [no provider key] FWPM_LAYER_INBOUND_IPPACKET_V4 {7dab1057-8e2b-40c4-9b85-693e381d7896}
Portmaster Packet Inbound IPv6 Callout Portmaster uses this layer to redirect/block/permit inbound ipv6 packets {fe9faf5f-ceb2-4cd9-9995-f2f2b4f5fcc0} [no provider key] FWPM_LAYER_INBOUND_IPPACKET_V6
Portmaster Packet Inbound IPv6 Filter Portmaster uses this layer to redirect/block/permit inbound ipv6 packets {b3f8b6de-beee-4300-8827-00a0b4484cdd} [no provider key] FWPM_LAYER_INBOUND_IPPACKET_V6 {7dab1057-8e2b-40c4-9b85-693e381d7896}
Portmaster Packet Outbound IPv4 Callout Portmaster uses this layer to redirect/block/permit outgoing ipv4 packets {f3183afe-dc35-49f1-8ea2-b16b5666dd36} [no provider key] FWPM_LAYER_OUTBOUND_IPPACKET_V4
Portmaster Packet Outbound IPv4 Filter Portmaster uses this layer to redirect/block/permit outgoing ipv4 packets {a64c7879-6f7d-4408-96db-f17755be0473} [no provider key] FWPM_LAYER_OUTBOUND_IPPACKET_V4 {7dab1057-8e2b-40c4-9b85-693e381d7896}
Portmaster Packet Outbound IPv6 Callout Portmaster uses this layer to redirect/block/permit outgoing ipv6 packets {91daf8bc-0908-4bf8-9f81-2c538ab8f25a} [no provider key] FWPM_LAYER_OUTBOUND_IPPACKET_V6
Portmaster Packet Outbound IPv6 Filter Portmaster uses this layer to redirect/block/permit outgoing ipv6 packets {cf9670ac-0493-466a-b52c-4a58e111c513} [no provider key] FWPM_LAYER_OUTBOUND_IPPACKET_V6 {7dab1057-8e2b-40c4-9b85-693e381d7896}
Portmaster Stream IPv4 Callout Portmaster uses this layer for bandwidth statistics of IPv4 TCP connections {e2ca13bf-9710-4caa-a45c-e8c78b5ac780} [no provider key] FWPM_LAYER_STREAM_V4
Portmaster Stream IPv4 Filter Portmaster uses this layer for bandwidth statistics of IPv4 TCP connections {38e37d21-805a-4ac9-8862-ed433d9c0cdf} [no provider key] FWPM_LAYER_STREAM_V4 {7dab1057-8e2b-40c4-9b85-693e381d7896}
Portmaster Stream IPv6 Callout Portmaster uses this layer for bandwidth statistics of IPv6 TCP connections {66c549b3-11e2-4b27-8f73-856e6fd82baa} [no provider key] FWPM_LAYER_STREAM_V6
Portmaster Stream IPv6 Filter Portmaster uses this layer for bandwidth statistics of IPv6 TCP connections {75b7fc3e-906c-4ae4-a110-522ba9baf6fb} [no provider key] FWPM_LAYER_STREAM_V6 {7dab1057-8e2b-40c4-9b85-693e381d7896}
Portmaster resource release IPv4 Callout Portmaster uses this layer to detect when a IPv4 port has been released {7b513bb3-a0be-4f77-a4bc-03c052abe8d7} [no provider key] FWPM_LAYER_ALE_RESOURCE_RELEASE_V4
Portmaster resource release IPv4 Filter Portmaster uses this layer to detect when a IPv4 port has been released {70b1371e-d9df-4a84-94c2-ea2c22255ddc} [no provider key] FWPM_LAYER_ALE_RESOURCE_RELEASE_V4 {7dab1057-8e2b-40c4-9b85-693e381d7896}
Portmaster resource release IPv6 Callout Portmaster uses this layer to detect when a IPv6 port has been released {6cf36e04-e656-42c3-8cac-a1ce05328bd1} [no provider key] FWPM_LAYER_ALE_RESOURCE_RELEASE_V6
Portmaster resource release IPv6 Filter Portmaster uses this layer to detect when a IPv6 port has been released {b7d1c87c-f3a6-4f79-87ef-d8fc34cf54b6} [no provider key] FWPM_LAYER_ALE_RESOURCE_RELEASE_V6 {7dab1057-8e2b-40c4-9b85-693e381d7896}
PortmasterSublayer SubLayer The Portmaster sublayer holds all it's filters. {7dab1057-8e2b-40c4-9b85-693e381d7896}
Teredo socket option opt out block filter Filter [no description] {a28667b6-4553-42aa-8297-5ea9bcc7961f} {977de843-e50e-4371-a702-c47f1f3da919} FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 {7b6b11f6-cbb5-433c-ae06-6a4f0076e49e}
VPN Reconnect Sublayer SubLayer [no description] {9367171b-3264-4f09-a0e8-81b38c162f17}
Worker Status: 3/54 (0?):
54 Workers: 3 running, 54 waiting
# State Module Name Worker Func Current Line Extra Info
1 running API http request github.com/safing/portmaster/base/api.(*mainHandler).ServeHTTP.func1 github.com/safing/portmaster/service/debug.go:58
1 syscall DNSMonitor etw-dns-event-listener github.com/safing/portmaster/service/firewall/interception/dnsmonitor.initializeSessions.func1 github.com/safing/portmaster/service/integration/etw_windows.go:73
1 syscall Interception kext packet handler github.com/safing/portmaster/service/firewall/interception.startInterception.func3 github.com/safing/portmaster/windows_kext/kextinterface/kext_file.go:61
1 chan receive Resolver mdns handler github.com/safing/portmaster/service/resolver.listenToMDNS github.com/safing/portmaster/service/resolver/resolver-mdns.go:147
2 select API database api writer github.com/safing/portmaster/base/api.(*DatabaseWebsocketAPI).writer github.com/safing/portmaster/base/api/database.go:155
2 select Rng feeder github.com/safing/portmaster/base/rng.(*Feeder).run github.com/safing/portmaster/base/rng/entropy.go:117
1 select Firewall bandwidth update handler github.com/safing/portmaster/service/firewall.bandwidthUpdateHandler github.com/safing/portmaster/service/firewall/packet_handler.go:838
1 select Firewall packet handler github.com/safing/portmaster/service/firewall.packetHandler github.com/safing/portmaster/service/firewall/packet_handler.go:823
1 select Interception kext bandwidth request worker github.com/safing/portmaster/service/firewall/interception.startInterception.func4 github.com/safing/portmaster/service/firewall/interception/interception_windows.go:70
1 select Interception kext clean ended connection worker github.com/safing/portmaster/service/firewall/interception.startInterception.func6 github.com/safing/portmaster/service/firewall/interception/interception_windows.go:103
1 select Interception kext log request worker github.com/safing/portmaster/service/firewall/interception.startInterception.func5 github.com/safing/portmaster/service/firewall/interception/interception_windows.go:87
1 select NetEnv monitor network changes github.com/safing/portmaster/service/netenv.monitorNetwSource: safing/portmaster