Docs › LAN resolution

FRITZ!Box: allow private answers

FRITZ!OS filters private answers under DNS Rebind Protection, with an exception list in the interface. It is on by default and there is no global switch to turn it off.

Confirm this is the problem

Run both from the machine that cannot resolve the name.

diagnose

dig +short nas.alice.home.network @1.1.1.1
dig +short nas.alice.home.network

Result	Meaning
First returns the address, second returns nothing	Your resolver is stripping the answer. Apply the fix below.
Both return nothing	The record is missing or wrong. Nothing on the router will help.

Check the status, not only the output. A stripped answer comes back NOERROR with ANSWER: 0, never NXDOMAIN. NXDOMAIN means the record does not exist. Querying @ns1.home.network proves only that the record exists, since it bypasses both resolvers and cannot tell the two cases apart.

The fix

Home Network ▸ Network ▸ Network Settings

Change Advanced Network Settings
  ▸ DNS Rebind Protection
    ▸ Add Exception:  alice.home.network

Apply to save. AVM's own instructions also call for restarting the box afterwards, under System ▸ Backup ▸ Restart. Entering the label alone does cover every name beneath it, though AVM documents only full host names, so the full name is the safe entry if one host is all you need.

Substitute your own label for alice. The exception covers every name beneath it, so it is added once rather than per device.

Why this happens

Rebind protection exists to stop a hostile public name resolving to an address inside your network. Pointing your own names at your own machines is the same shape as that attack and cannot be distinguished automatically, so resolvers take an allowlist instead. Naming one domain you control is the narrowest possible exception.

← All documentation