Unbound and Round Robin DNS

Unbound
1

Hi,

I am in the process of testing unbound and have found the following with round robin dns entries.

Using www.cnn.com as an example, unbound gives me the same answer (157.166.255.19) everytime whereas bind gives me the intended different answers. Example below.

Command used was while true; do date; nslookup www.cnn.com| head -n6 ; sleep 1; done

Unbound
Version 1.3.3
linked libs: event 1.4.12-stable, ldns 1.6.0_20090714, OpenSSL 0.9.8e 23 Feb 2007
linked modules: validator iterator

Fri Aug 21 12:01:28 SAST 2009
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: www.cnn.com
Address: 157.166.255.19
Fri Aug 21 12:01:29 SAST 2009
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: www.cnn.com
Address: 157.166.255.19
Fri Aug 21 12:01:30 SAST 2009
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: www.cnn.com
Address: 157.166.255.19
Fri Aug 21 12:01:31 SAST 2009
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: www.cnn.com
Address: 157.166.255.19
Fri Aug 21 12:01:32 SAST 2009
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: www.cnn.com
Address: 157.166.255.19
Fri Aug 21 12:01:33 SAST 2009
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: www.cnn.com
Address: 157.166.255.19

Bind version
BIND 9.4.3-P3

Fri Aug 21 12:06:47 SAST 2009
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: www.cnn.com
Address: 157.166.224.25
Fri Aug 21 12:06:48 SAST 2009
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: www.cnn.com
Address: 157.166.255.19
Fri Aug 21 12:06:49 SAST 2009
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: www.cnn.com
Address: 157.166.255.18
Fri Aug 21 12:06:50 SAST 2009
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: www.cnn.com
Address: 157.166.226.26
Fri Aug 21 12:06:51 SAST 2009
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: www.cnn.com
Address: 157.166.226.25
Fri Aug 21 12:06:52 SAST 2009
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: www.cnn.com
Address: 157.166.224.26

Is there something I need to set in unbound to get it to return the random answers like bind does?

Thanks

Gareth

2

dig against unbound gives me :

;; ANSWER SECTION:
www.cnn.com. 266 IN A 157.166.224.26
www.cnn.com. 266 IN A 157.166.226.25
www.cnn.com. 266 IN A 157.166.226.26
www.cnn.com. 266 IN A 157.166.255.18
www.cnn.com. 266 IN A 157.166.255.19
www.cnn.com. 266 IN A 157.166.224.25

Seems like they use a TTL of 300. Asking unbound with nslookup gives all 6
records, but I guess unbound is not cycling them in any way, so you keep
getting the first record. Perhaps Wouter can explain that part, as I am
sure some conscious design decision has gone into that.

But in 300 seconds, things will change. For me, the list got returned
the second time as:

;; ANSWER SECTION:
www.cnn.com. 300 IN A 157.166.255.19
www.cnn.com. 300 IN A 157.166.224.25
www.cnn.com. 300 IN A 157.166.224.26
www.cnn.com. 300 IN A 157.166.226.25
www.cnn.com. 300 IN A 157.166.226.26
www.cnn.com. 300 IN A 157.166.255.18

So to my applications (eg ping) their address changed from 157.166.224.26
to 157.166.255.19.

Paul

3

Perhaps Wouter can explain that part, as I am sure some conscious design
decision has gone into that.

I'm guessing this is the same anti-feature-creep sentiment as why
round-robinning RRs was left out of NSD. This is unfortunate, because very
few clients bother to use anything but the first IP returned by their
resolver.

But in 300 seconds, things will change. For me, the list got returned
the second time as:

This would not be true if cnn.com were served by NSD. The ordering would by
the same, every time, resulting in at least 3x the load reaching the first
IP in the zone file.

                                     -- Aaron

4

Hi Aaron and Paul,

Thanks for the replies.

If I read this correctly, this seems to negate the whole point of using dns round robin.

Depending on what my TTL is set to, all queries will be delivered to the first host, whether
there are 3 or 30 hosts, and will continue to be delivered to that host until the TTL expires
and the cache goes and fetches the records again.

Hopefully I am reading this incorrectly and it is possible to get unbound to cycle through
its records.

Cheers,

Gareth

5

Yes.

Unbound tries very hard to preserve the original answer.
Its lower and uppercase use in names.
And also the ordering in the data and RRSIG records.
Also, it is faster and anti-feature-creep.

Best regards,
   Wouter