Unbound doesn't accept answer from non-DNSSEC forward rule

Question

Unbound gets the right answer (see below) from a forward-zone, but proceeds to ignore it and try to query other DNS servers.

I'm running unbound (1.10.0) on a docker image when behind a public hotspot.

I've added forward-rules to allow communication when detecting that a login is required.

Important note: At this moment I don't have access to internet, I can just ping a local DNS in the router and a couple of domains.

Here's the unbound log

And the config file: (unbound.conf)

From the logs I can see that it has correct response from the forward-zone dns server.

unbound    | [1587387141] unbound[1:0] info: incoming scrubbed packet: ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
unbound    | ;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 
unbound    | ;; QUESTION SECTION:
unbound    | telekom.portal.fon.com.    IN  A
unbound    | 
unbound    | ;; ANSWER SECTION:
unbound    | telekom.portal.fon.com.    42099   IN  A   87.140.198.194
unbound    | 
unbound    | ;; AUTHORITY SECTION:
unbound    | 
unbound    | ;; ADDITIONAL SECTION:
unbound    | ;; MSG SIZE  rcvd: 56

But then proceeds to query root dns servers or other forward-zones I have defined.

It seems to work if I remove/comment from the config the following line:

auto-trust-anchor-file: "var/root.key"

But it's not sensitive to any other configuration option.

Thanks

edit: it proceeds to query root dns servers, not root hosts

Here https://gist.github.com/averissimo/929137bfe8cab8387efeb4a731ad48d3 — shil88, Apr 20 '20 at 20:03
On unbound docker `nameserver 127.0.0.11 options ndots:0` (it ends in and on the host `nameserver 127.0.0.1`) — shil88, Apr 20 '20 at 21:57

score 1 · Accepted Answer · answered Apr 24 '20 at 00:01

This was solved adding the domain-insecure option to unbound.conf

Found the answer at bugs.debian.org

This is the diff that allowed it to work

diff --git a/etc-unbound/unbound.conf b/etc-unbound/unbound.conf
index 0371a99..3fe25d6 100644
--- a/unbound.conf
+++ b/unbound.conf
@@ -306,6 +306,8 @@ server:
     # Include file for local-data and local-data-ptr
     include: /opt/unbound/etc/unbound/a-records.conf

+    domain-insecure: "portal.fon.com"
+
     ###########################################################################
     # FORWARD ZONE
     ###########################################################################

Unbound doesn't accept answer from non-DNSSEC forward rule

1 Answers1