Cachcing only server for all types of records

Unbound
1

Hi All,

I need a caching only local dns, for ALL type of records (A/AAAA/CNAME/PTR etc). Is this configuration what I need?

/etc/unbound/unbound.conf

server:
infra-cache-numhosts: 10000
do-ip4: yes
do-ip6: yes
do-udp: yes
do-tcp: yes
do-daemonize: yes
username: “unbound”
directory: “/etc/unbound”
use-syslog: yes
log-time-ascii: yes
prefetch: yes
prefetch-key: yes
rrset-roundrobin: yes
minimal-responses: yes

local-zone: “10.in-addr.arpa.” nodefault
local-zone: “16.172.in-addr.arpa.” nodefault
local-zone: “24.172.in-addr.arpa.” nodefault
local-zone: “25.172.in-addr.arpa.” nodefault
local-zone: “26.172.in-addr.arpa.” nodefault
local-zone: “28.172.in-addr.arpa.” nodefault
local-zone: “29.172.in-addr.arpa.” nodefault
local-zone: “31.172.in-addr.arpa.” nodefault
local-zone: “168.192.in-addr.arpa.” nodefault

include: /etc/unbound/local.d/.conf
include: /etc/unbound/conf.d/.conf

/etc/unbound/conf.d/forward.conf

forward-zone:
name: “.”
forward-addr: 172.16.16.10
forward-addr: 172.16.15.10
forward-addr: 172.16.8.10
forward-addr: 172.16.14.10

Greetz
Christoph Kaminski

2

Hi Cristoph,

Hi All,

I need a caching only local dns, for ALL type of records
(A/AAAA/CNAME/PTR etc). Is this configuration what I need?

Yes it seems to be what you want. It caches all types of responses
(it has a fairly small cache, a couple megabyte, the default for rr
and msg cache sizes), and it sends all upstream queries to a fixed
list of servers.

Best regards,
   Wouter

3

> Hi Cristoph,
>
> On 12/06/15 09:04, Christoph Kaminski wrote:
> > Hi All,
> >
> > I need a caching only local dns, for ALL type of records
> > (A/AAAA/CNAME/PTR etc). Is this configuration what I need?
>
> Yes it seems to be what you want. It caches all types of responses
> (it has a fairly small cache, a couple megabyte, the default for rr
> and msg cache sizes), and it sends all upstream queries to a fixed
> list of servers.
>
> Best regards,
> Wouter
>

ok thx for your answer... I have one question more. Sometimes I need to restart unbound in order that it can resolve a new added DNS record. I think the default cache times are to long for us. It is possible to make them shorter? The best would be if it only uses the cache if it cant reach any forwarder. Possible?

Greetz

4

Are you referring to the situation that happens when you query for
a non-existing name, and Unbound caches the authoritative NXDOMAIN
reply from the zone servers – and then you add the name to the zone,
but Unbound has cached the NXDOMAIN and still returns that as a reply?

If no: Please explain the situation.

If yes: Are you the zone admin? Unbound is correctly caching the
authoritative response from the zone servers. This is called negative
caching and has its own RFC https://tools.ietf.org/html/rfc2308 due to
all the subtleties involved.

In short, you may have success with tuning the zone's SOA minimum
field, ref https://tools.ietf.org/html/rfc2308#section-5

sven

5

And I just saw the 1.5.4rc1 release note about cache-max-negative-ttl,
which can be used in this sort of situation; very useful when you
don't have control of the zone.

https://github.com/jedisct1/unbound/commit/0ef133ea5819fbf7518de9c8492c5e05c95ac8ce

(@NLnet Labs: Is it possible to link to browsable svn commits?)

sven