Questions tagged [unbound]
Unbound is an open-source DNSSEC validating DNS resolver.
74
questions
0
votes
0
answers
37
views
local ACME with DNS challenge unbound
I would like to run nginx, traefik, or whatever is needed to do a DNS challenge over ACME.
If possible, without an additional app like Certbot. But even with certbot, as far as I can see, unbound ...
-2
votes
1
answer
571
views
How does DNS work in wg-quick?
I am trying to setup a VPN with two hops: traffic coming from the client gets routed through a VPS server and then to mullvad vpn:
https://i.sstatic.net/CbKJEd1r.png
Everything works just fine, but I'...
0
votes
0
answers
143
views
Unbound local-zone use Wildcard for any Subdomain
The idea is to configure unbound so that it resolves only mydomain.tld, but not any of its subdomains. For example www.mydomain.tld should not be resolved.
Have tried the following, but without ...
- 1
0
votes
1
answer
116
views
Can Force a cache-min-ttl For Only PTR Records
I have configured Unbound to act as a recursive DNS server. Trying to understand is it possible to configure it so that it caches a specific type of record, PTR, longer than what the TTL is in the ...
0
votes
1
answer
2k
views
unbound local-zone and local-data: am I doing it right?
I'm playing with unbound to forward DNS queries to an authoritative DNS server, cache them, and also add additionals local informations.
My config is pretty straightforward:
/etc/unbound/unbound.conf:
...
- 113
0
votes
0
answers
56
views
AWS OpenVPN server - accessing other instances
Happy new year!
I've just set up an AWS account and have three instances at the moment (one is for a Certificate Authority so is largely irrelevant). Both are running on Ubuntu 22.04, one is hosting ...
- 1
0
votes
1
answer
170
views
Why does unbound pass dohclient test but fails 404 with curl and firefox?
I have built a DoH resolver with unbound and my simple configuration tests correctly:
unbound-checkconf: no errors in /unbound/unbound.conf
My next test is to use the included dohclient:
dohclient -s ...
- 221
0
votes
1
answer
145
views
Can I use my letsencrypt wildcard cert on BOTH my webserver and DoH server?
I use letsencrypt wildcard certificate on www.mydomain.com and it works all fine.
Since it is a wildcard, I can validate SSL on *.mydomain.com.
Now I have a recursive resolver running unbound that I ...
- 221
0
votes
0
answers
69
views
Use multiple types of upstreams in single unbound.conf
Is there a way to specify forwarder type with its address?
Example config I imagine:
forward-zone:
name: "."
forward-addr: dot.example.resolver@tls:853
forward-addr: ...
- 1
1
vote
1
answer
3k
views
How to configure unbound to forward local hostname resolution to my local DNS server?
How can I configure unbound to forward local hostname resolution to my local DNS server (e.g., 192.168.1.1), i.e. for hostnames without any dot, such as "foo"?
Note that for all the other ...
- 253
1
vote
1
answer
738
views
unbound DNS without recursive
I want to configure the unbound DNS for the domain e.g. domain.com in a way that it only answers for *.domain.com and rest of any query like gmail.com or hotmail.com are refused.
I have following ...
- 13
-1
votes
1
answer
1k
views
Docker Container DNS slow (~ 4 seconds) with DNS resolver as container
DNS resolution inside all of my Docker containers is consistently slow (slightly more than 4 seconds). From the host, DNS queries are fast, as well as on the rest of my network.
I must admit I did not ...
- 1
2
votes
1
answer
4k
views
Automate renewal of let's encrypt ACME-DNS challenge with unbound
I changed from a certificate with multiple explicitly defined subdomains to a wildcard certificate. For this to work, the DNS-01 challenge needs to be solved. I have a very basic unbound DNS server ...
- 63
0
votes
1
answer
969
views
RCVD_IN_DNSWL_BLOCKED in SpamAssassin as it doesn't use local DNS
I'm not sure what I have wrong here. It used to work on Ubuntu 18.04, but doesn't on 20.04 it seems. I have unbound DNS server setup:
unbound-control status
version: 1.9.4
verbosity: 1
threads: 1
...
- 1,194
1
vote
1
answer
977
views
Unbound as a caching intermediate server is slow, and doing more than what I need
What I need
A forwarding DNS server as an intermediry to another DNS server that serves expired records and renews its cache later.
Problem
I tried to use unbound as the only software that I've found ...
- 158
1
vote
1
answer
942
views
redirect outgoing dns queries to localhost using iptables
Problem
There are some outgoing TCP DNS requests in my Ubuntu server that I couldn't control them to be resolved by Unbound on 127.0.0.1:53 which uses 208.67.222.222 to resolve everything, and I see ...
- 158
0
votes
1
answer
517
views
Investigate huge recursion delay with Unbound
I am running a recursive DNS resolver with unbound 1.9.0 on Debian Stretch. It periodically logs statistics about the recursion procession times. The latest is:
[2195:0] info: server stats for thread ...
- 1,394
2
votes
0
answers
181
views
When does unbound fully drop expired cache
How long it will hold expired cache before dropping it? Is there any way to prefetch expired cached instead of dropping it?
- 133
0
votes
1
answer
1k
views
How to whitelist domain in Unbound
I know that sometimes false positive can happen when using public blocklists, that way I want to import/create whitelist to make sure not to block them.
I've already checked manual from Unbound and ...
- 459
0
votes
1
answer
176
views
Putting a caching nameserver in front of ad
I would like to set up a caching nameserver to meet some requirements in the datacenter. Some of these requirements make me to put this caching nameserver between my servers and AD (e.g. collecting ...
- 33
0
votes
0
answers
547
views
Unbound DNS (Redirection of LAN)
I'm trying to redirect my LAN queries to local DNS server (installed in LAN) instead of default DNS ie 8.8.8.8.
I'm using unbound 1.13.1 and tried the following:
tried localzone
local-zone: "10....
- 9
0
votes
0
answers
469
views
Centos - Unbboud and URIBL_BLOCKED blacklist
I am facing the following problem:
My websites have contact forms. People reach out to me via contact form. I receive 1 email after every contact form sent.
Since about 1 week Ms Outlook is marking my ...
- 359
4
votes
1
answer
3k
views
Understanding how Unbound listen on Port 53
I have installed unbound on Debian Buster. Now I wonder why unbound listens 2 times on each Protocol.
netstat -tulpn
tcp 0 0 0.0.0.0:53 0.0.0.0:* LISTEN ...
- 715
3
votes
1
answer
5k
views
DNS - Unbound - How to provide different IP for a server based on client network
We have an intranet DNS server using Unbound in FreeBSD. We have another file server with multiple network IP, First one is 10.10.10.10 and Second one in 192.168.10.10.
Is there any way that DNS ...
- 155
1
vote
1
answer
711
views
Can't Receive Email - Postfix iRedMail Server Using Spamhaus & Unbound / BIND9 DNS Servers
iRedMail server configured using ISP's DNS servers. Running several years without issue. Moving from current ISP to Starlink. It appears Starlink uses Cloudflare's public DNS. Currently have both ISPs ...
- 11
6
votes
2
answers
6k
views
How does unbound handle multiple forwarders (forward-addr)?
According to https://nlnetlabs.nl/documentation/unbound/unbound.conf/ multiple forwarders can be configured with forward-addr
For the forward zone this list of nameservers is used to forward the
...
- 337
1
vote
0
answers
309
views
how to make unbound hold many queries for non cached address to cache it first
I am looking for a way to make unbound hold queries for the same address lookup when it is not cached. It should let only one query to be processed, after that answer cached it can reply other queries ...
- 33
1
vote
2
answers
360
views
Unbound sends recursive queries from default gateway
I am looking for an option that will make unbound to send recursive queries from a specific interface.
Listening interface is easy, but I can't find asking interface option.
I have 3 interfaces on my ...
- 33
0
votes
1
answer
5k
views
Unbound error - unbound.service: Start request repeated too quickly
I am new using unbound.
I have a network 192.168.50.1 to 192.168.50.240. And I'd like to use DoH for non cache data.
my conf file:
# Unbound configuration file for Debian.
#
# See the unbound.conf(5) ...
- 101
2
votes
1
answer
1k
views
Unbound block list , How to know from query log that if domain blocked or not?
I have configured an Unbound server with domain block list, blocking works perfectly fine.
But from the query log, i can only see that blocked domain is queried, that's it.
I tired with
server:
local-...
- 91
0
votes
0
answers
1k
views
Unbound not returning A records over IPv6
I recently replaced my pfSense installation with OPNsense and have been struggling a bit with the Unbound installation.
In short, it's IPv6 enabled and everything works well (both IPv6 and IPv4) in ...
- 971
1
vote
1
answer
1k
views
Runing unbound doh behind nginx
I'm trying to run unbound DoH behind nginx but I'm getting a 502 Bad Gateway error.
In nginx log I have the following message:
2021/03/25 08:54:49 [error] 10052#10052: *1 upstream prematurely closed ...
- 121
2
votes
0
answers
5k
views
Bind9 vs Unbound. Which is better for VPN node and why?
I am currently in the process of developing a VPN service. One of the necessary things for a proper VPN node is a DNS server that will prevent DNS leaks, and whilst working on this project I stumbled ...
- 21
0
votes
0
answers
3k
views
Fallback to forwarding with Unbound?
I'm using Unbound on an internal network What I want it to do is as follows:
If a local_zone matches, return from there
If not and it matches the internal domain name, then try forwarding to Consul ...
1
vote
1
answer
3k
views
Unbound doesn't accept answer from non-DNSSEC forward rule
Unbound gets the right answer (see below) from a forward-zone, but proceeds to ignore it and try to query other DNS servers.
I'm running unbound (1.10.0) on a docker image when behind a public ...
- 121
3
votes
1
answer
4k
views
Unbound can't seem to read certificate files for DNS-over-TLS, gets "Permission denied"
I'm trying to set up DNS-over-TLS (DoT) with unbound resolver. i.e. I'm trying to encrypt the connection between the client and unbound I'm NOT trying to encrypt the unbound resolver → upstream ...
- 3,701
0
votes
1
answer
670
views
Measuring/monitoring Unbound Resolver Performance
I am running Unbound resolver on FreeBSD, and i am looking for a solution to measure its performance.sometimes there are some delays in regard of resolving domain names,and my customers are ...
- 783
2
votes
0
answers
2k
views
Unbound DNS Partial Authority of Zone
There is a public domain registered by somebody on the Internet. Let's say "example.com".
I need my Unbound server to be partially authoritative for the zone "example.com" for my internal client ...
- 21
1
vote
1
answer
772
views
unbound periodically stops working
I have been using unbound as a caching DNS server forwarding to dnscrypt-proxy and it was working relatively well for a while (years, although about a year or so with dnscrypt-proxy) requiring no ...
- 243
2
votes
0
answers
6k
views
Dig +trace not working, while +notrace works
I am trying to troubleshoot some DNS issues and I am starting by trying to trace my DNS lookups using dig +trace. Im getting some weird results. If do a normal dig to my unbound resolver.
dig @192....
- 21
0
votes
2
answers
3k
views
unbound.service service unit slow start/restart on 1 VM and fast on another
I am debugging an issue with Unbound (DNS Resolver software) on CentOS Linux release 7.5.1804 (Core). I have 2 VMs in different environments that are supposedly running the same Unbound software.
[...
- 49
1
vote
0
answers
2k
views
Unbound config to forward unknow local subdomain name
I am currently on a local aera network where no loop-back is allowed meaning that I cannot reach my public IP address from the local network.
Several services need to be migrated in my local area ...
- 11
1
vote
0
answers
2k
views
Unbound forward-zones of subdomains overlap
I have a subdomain (imap) that is accessible from an external network and I have some subdomains (file-drive) that are only accessible form the internal network. I do not have access to the dns-server ...
- 111
2
votes
1
answer
7k
views
unbound.conf server option "private-domain" - domain name ending in a dot nor not?
unbound.conf is used to configure Unbound, a caching DNS resolver. The documentation of version 1.6.8 says:
Server Options
private-domain: <domain name>
Allow this domain, and all ...
- 417
2
votes
1
answer
30k
views
Unbound doesnt start
after installing Unbound
apt-get -y install unbound dnsutils
su -c "unbound-anchor -a /var/lib/unbound/root.key" - unbound
systemctl reload unbound
apt-get -y install resolvconf
echo "nameserver ...
- 123
2
votes
0
answers
2k
views
Unbound DNS: how to ask forwarders only after direct NS query is failed
By default, Unbound DNS server works by "classic" scheme: queries root servers for zone NS records, then queries NS'es for A/AAAA/...
Sometime (rarely) connectivity between my DNS and target NS'es is ...
- 427
3
votes
2
answers
15k
views
unbound forward zone syntax
I want to configure unbound to lookup certain domain names with an alternative dns server, with forward-zone. The documentation I find have two syntaxes:
forward-zone:
name: "mynetwork.com."
forward-...
- 133
4
votes
1
answer
6k
views
Configure LXC to use specific DNS server instead of DNSMASQ
Out of the box, my LXC containers connect to a running instance of dnsmasq, which is started with the lxc-net service.
In my case, I am running a local unbound DNS server that connects to a thing ...
- 263
0
votes
1
answer
827
views
Setup Unbound DNS for both caching/local usage and website ns
I want to use Unbound as caching and as my ns1.domain.com nameserver with DNSSEC.
I came across Unbind which looks quite easy to setup and use.
unbound-control local_data "mywebsite.com A 11.22.3.44"...
- 165
-1
votes
2
answers
2k
views
Unbound : what capacity will i need on drive? [closed]
I'm planning to set up my own dns server (for a cybercafe, 30 computers)
what size will unbound need on hdd after months of use ?
Mb, Gb, Tb ?
- 17