we have Unbound 1.4.6 as caching resolver for our internal network which in turn forward queries to Bind 9.7 at the border. It works fine except for our remote location (VPN) which uses 10.2.0.0/16 as internal network.
If have checked that Bind 9.7 can resolve both fine but Unbound only resolves "domain1.de" internal addresses correctly which are located in 10.1.0.0/16 and not "domain2.cz" which are at 10.2.0.0/16. For domain2.cz we always get timeout from Unbound despite the fact the Unbound has asked Bind and have got the correct result?
Zitat von "W.C.A. Wijngaards" <wouter@NLnetLabs.nl>:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Andreas,
What are the private-address: settings (esp. about 10.2/16)?
Is this about PTR queries or A queries?
Hello
First problem are A queries eg. "some.internal.domain1.de" works while "some.internal.doamin2.cz" are not working. But the PTR queries don't work either for 10.2.0.0/16.
As said the upstream Bind resolves both fine (checked by tcpdump) because it has internal.domain1.de and internal.domain2.cz as slave zones from the Windows DNS servers.
Zitat von "W.C.A. Wijngaards" <wouter@NLnetLabs.nl>:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Andreas,
What are the private-address: settings (esp. about 10.2/16)?
Is this about PTR queries or A queries?
Sorry, forgot the first question. The "private-address:" is not set at all, so Unbound should not stripe anything i guess?
May it be related to the fact that the .cz TLD is DNSSEC signed and the .de not? Both subdomains don't use DNSSEC until now and have no trust chain but that's the only difference i came up with...
Zitat von "W.C.A. Wijngaards" <wouter@NLnetLabs.nl>:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Andreas,
Zitat von lst_hoe02@kwsoft.de:
Sorry, forgot the first question. The "private-address:" is not set at
all, so Unbound should not stripe anything i guess?
May it be related to the fact that the .cz TLD is DNSSEC signed and the
.de not? Both subdomains don't use DNSSEC until now and have no trust
chain but that's the only difference i came up with...
Yes if your own domain is not signed, then you must give:
domain-insecure: "domain2.cz"
So that unbound understands that there is no DS record published in .cz
for domain2.cz.
Okay, with "domain-insecure: domain2.cz" it works. But it strikes me odd why the internal.domain2.cz is different from Unbound point of view then any other .cz domain? After all Unbound does forward all queries anyway to the upstream Bind. I guess it is best to list all private domains also as insecure domain in case the TLDs will be signed some day.