1

Good dag.

In my network, I have two dns cache/resolvers:

  • Dnsmasq on the router.
  • Unbound on another server.

Dnsmasq runs perfect. It provides local dns from the dhcp and the hosts file.

Unbound is setup to forward all requests to local domains and addresspace to Dnsmasq. This used to work great until around two weeks ago.

The rest is supposed to follow to usual dns resolution. Additionally, the global resolution has DNSSEC validation and dns64 (this part works great).

When I request unbound for resolution in my network, I can get slow answers or wrong ones :

dig @unbound -x 2a06:...:5367
hanging...
dig +short @unbound blackblock4.22decembre.eu any
10.0.0.2
64:ff9b::a00:2

(We can see that Unbound indeed fetch the info at Dnsmasq's. Then it adds dns64, which is wrong.)

Whereas dnsmasq responds perfect:

dig @mirror +short -x 2a06:...:5367
jabberwocky.22decembre.eu
dig +short @mirror blackblock4.22decembre.eu any
10.0.0.2

Here is the unbound conf :

server:
# verbosity number, 0 is least verbose. 1 is default.
verbosity: 1

# number of threads to create. 1 disables threading.
num-threads: 4

outgoing-range: 206
outgoing-interface: 2a06:...::2
outgoing-interface: fd00:2016:22:dec::3
outgoing-interface: 10.0.0.2

unwanted-reply-threshold: 1000000

interface: ::1
interface: fd00:2016:22:dec::3
interface: 10.0.0.3
interface: 127.0.0.1

# upstream connections use TCP only (and no UDP), "yes" or "no"
# useful for tunneling scenarios, default no.
# tcp-upstream: no

harden-below-nxdomain: yes
harden-dnssec-stripped: yes

harden-algo-downgrade: yes
harden-glue: yes

private-address: fd00:2016:22::/48
private-address: 10.0.0.0/8

# Uncomment to enable qname minimisation.
# https://tools.ietf.org/html/draft-ietf-dnsop-qname-minimisation-08
#
qname-minimisation: yes

access-control: 0.0.0.0/0 refuse
access-control: 127.0.0.0/8 allow
access-control: 10.0.0.0/8 allow

access-control: ::0/0 refuse
access-control: ::1/128 allow
access-control: fd00:...:22::/48 allow

statistics-interval: 0
statistics-cumulative: no
extended-statistics: yes

module-config: "dns64 validator iterator"
dns64-prefix: 64:FF9B::/96
trust-anchor-file: "/var/unbound/db/root.key"

chroot: "/var/unbound"
use-caps-for-id: yes

cache-min-ttl: 3600
cache-max-ttl: 86400

prefetch-key: yes
prefetch: yes

root-hints: "named.cache"

unblock-lan-zones: yes
insecure-lan-zones: yes

local-zone: "22decembre.eu." nodefault
local-zone: "22december.dk." transparent
local-zone: "10.in-addr.arpa." transparent
local-zone: "d.f.ip6.arpa." transparent
local-zone: "2.2.0.0.6.1.0.2.0.0.d.f.ip6.arpa." transparent

private-domain: "22decembre.eu."
private-domain: "22december.dk."

domain-insecure: "22decembre.eu."
domain-insecure: "22december.dk."
domain-insecure: "10.in-addr.arpa."
domain-insecure: "2.2.0.0.6.1.0.2.0.0.d.f.ip6.arpa."

forward-zone:
    name: "10.in-addr.arpa."
    forward-addr: fd00:2016:22:dec::1

stub-zone:
    name: "22decembre.eu."
    stub-addr: fd00:2016:22:dec::1
    stub-first: yes

stub-zone:
        name: "22december.dk."
    stub-addr: fd00:2016:22:dec::1
    stub-first: yes

forward-zone:
        name: "d.f.ip6.arpa."
        forward-addr: fd00:2016:22:dec::1

forward-zone:
        name: "2.2.0.0.6.1.0.2.0.0.d.f.ip6.arpa."
    forward-addr: fd00:2016:22:dec::1


stub-zone:
        name:    "....6.0.a.2.ip6.arpa."
        stub-addr: fd00:2016:22:dec::1

Unbound is Version 1.6.1 on OpenBSD stable. linked libs: pluggable-libevent 1.4.15-stable (it uses kqueue), LibreSSL 2.5.2 linked modules: dns64 validator iterator.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.