Unbound not resolving specific domain?

Unbound
1

Hi community,

Newbee here. I am running Unbound as a local dns server for my rspamd instance on an RPi4 for some time. Seems to work OK. Recently decided to use it for my local network. Seemed to work OK too. Until today I was trying to visit www.lumc.nl which I couldn’t.

I discovered that unbound could not resolve the domain.

On the RPI4 command line dig lumc.nl resulted in 3 communication errors that timed out and after that the correct answer from some ipv6 host.

Searched the internet for this issue but no solution found.

dig @8.8.8.8 lumc.nl worked correctly. Also tried to add a forward-zone to 8.8.8.8 for lumc.nl but that gives the same error.

My unbound.conf:

server:
    verbosity: 2
    num-threads: 4
    interface: 0.0.0.0
    edns-buffer-size: 1472
    max-udp-size: 4096
    discard-timeout: 3000
    infra-cache-min-rtt: 1126

    do-ip4: yes
    do-ip6: yes
    do-udp: yes
    do-tcp: yes

    use-systemd: no
    do-daemonize: yes

    access-control: 127.0.0.0/8 allow
    access-control: 192.168.178.0/24 allow

    chroot: ""

    username: "unbound"

    logfile: "/var/log/unbound.log"

    log-time-ascii: yes

    root-hints: "/var/lib/unbound/root.hints"

    harden-glue: yes

    harden-dnssec-stripped: yes

    qname-minimisation: no

    aggressive-nsec: yes

    prefetch: yes

    auto-trust-anchor-file: "/var/lib/unbound/root.key"

    trust-anchor-signaling: yes

    root-key-sentinel: yes

    val-permissive-mode: yes

python:

dynlib:

remote-control:
        control-enable: no
        control-interface: 127.0.0.1
        control-interface: ::1

btw I am running the latest 1.26.0 built from source on Slackware(SarPi aarch64)

2

Hi again,

This problem is solved. Turned out to be the authoritative server was missing DNSSEC data.

Marked lumc.nl as insecure.

But now there is another problem:

dig postfix.org resolves ok but the page is not loaded in my browser.

Tried a forward-zone to 8.8.8.8 and configured it as insecure but both did not work.

This is my current unbound.conf:

server:
        verbosity: 2
        num-threads: 4
        interface: 0.0.0.0

        do-ip4: yes
        do-ip6: no 
        do-udp: yes
        do-tcp: yes

        use-systemd: no
        do-daemonize: yes

        access-control: 127.0.0.0/8 allow
        access-control: 192.168.178.0/24 allow

        chroot: ""
        username: "unbound"
        logfile: "/var/log/unbound.log"
        log-time-ascii: yes
        root-hints: "/var/lib/unbound/root.hints"
        harden-glue: yes
        harden-dnssec-stripped: yes
        qname-minimisation: no
        aggressive-nsec: yes
        prefetch: yes
        auto-trust-anchor-file: "/var/lib/unbound/root.key"

# insecure domains not supporting dnssec
        domain-insecure: "lumc.nl"
        domain-insecure: "spamhaus.net"
        domain-insecure: "uribl.com"
        domain-insecure: "rspamd.com"
        domain-insecure: "dsnwl.org"
        domain-insecure: "surbl.org"
        domain-insecure: "spameatingmonkey.net"
        domain-insecure: "blocklist.de"
        domain-insecure: "msbl.org"

python:

dynlib:

remote-control:
        control-enable: yes
        control-interface: 127.0.0.1
        control-port: 8953
        server-key-file: "/etc/unbound/unbound_server.key"
        server-cert-file: "/etc/unbound/unbound_server.pem"
        control-key-file: "/etc/unbound/unbound_control.key"
        control-cert-file: "/etc/unbound/unbound_control.pem"

No problems at all with loading other sites

dig postfix.org resolves ok so no errors in log

lumc.nl loads ok too…

what else to try?

3

Hi,

Given that Unbound was able to resolve postfix.org, the problem with the web page not loading is probably not down to the DNS. I was wondering if you’re still unable to load the web page?

Kind regards,

-- Benno

4

Hi Benno,

Thanks for reply. Somehow somewhere I added the mirror that hosts postfix.org as domain-insecure. After I removed it I could visit www.postfix.org ok. So problem seems solved.

Thanks anyhow

Dik