Unbound Test Validation both report SERVFAIL

[eloyaldea]

Describe the bug Trying to set up unbound to use with Pi-Hole (following this guide), the test validation commands both give the status report of SERVFAIL, making unbound not work.

To reproduce Steps to reproduce the behavior: (These are the commands from the guide of course)

1. Install unbound with sudo apt install unbound
2. Create /etc/unbound/unbound.conf.d/pi-hole.conf with sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf
3. Copy contents from the guide to the file, save and exit.
4. Start unbound with sudo service unbound restart and test first with dig pi-hole.net @127.0.0.1 -p 5335
5. Test validation with dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5335 and dig sigok.verteiltesysteme.net @127.0.0.1 -p 5335

Expected behavior The command dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5335 should report a status of SERVFAIL, which it does; but the command dig sigok.verteiltesysteme.net @127.0.0.1 -p 5335 should report a status of NOERROR which it doesn't, it also shows a SERVFAIL like the first command.

System:

• Unbound version: 1.9.0
• OS: 5.10.60-v7+ #1449 SMP Wed Aug 25 15:00:01 BST 2021 armv7l GNU/Linux
• unbound -V output:

  [1631314649] unbound[3551:0] notice: Start of unbound 1.9.0. [1631314649] unbound[3551:0] warning: so-rcvbuf 1048576 was not granted. Got 360448. To fix: start with root permissions(linux) or sysctl bigger net.core.rmem_max(linux) or kern.ipc.maxsockbuf(bsd) values. [1631314649] unbound[3551:0] error: can't bind socket: Address already in use for 127.0.0.1 port 5335 [1631314649] unbound[3551:0] fatal error: could not open ports

Additional information Hi! I'm currently running Pi-Hole inside a RaspbianOS on a Raspberry 3 and it's running fine. I wanted to take the next step and running Pi-Hole with unbound using this guide from the Pi-Hole website. Unfortunatelly as shown above unbound doesn't pass the validation test as it reports SERVFAIL with every domain you try to enter. I have tried with DNSSEC enabeld and disabled and it doesn't make a difference.

[wcawijngaards]

So the error is prints is that it cannot open the port number because there is already another server running on that port number. Unbound then exits with the fatal error. This means that unbound is not running on your system. The responses you get must be from another piece of software.

[eloyaldea]

Mmmm I don't know what to respond, this is a Raspberry that I only use it for Pi-Hole so I don't know what could be causing the issue. Maybe it's because I'm having an ssh session into the Raspberry from my computer? I don't know what steps I could follow to solve this.

[wcawijngaards]

Is the output that you quoted from the unbound -V? In that case what you are missing out on is the log messages from unbound. These are sent to syslog. You can also edit unbound.conf to send them to a file so you can find them. You can also increase the verbosity: value, to say, about 4. That logs a lot more details about what is going on. Then you look for why the servfail is happening, likely something to do with not being able to contact the network, since you already ruled out DNSSEC as a cause.

[crowdh]

Hi, reviving an old archive. As the dude said. < Test validation¶ You can test DNSSEC validation using dig fail01.dnssec.works @127.0.0.1 -p 5335 dig dnssec.works @127.0.0.1 -p 5335

For me it returns : dig fail01.dnssec.works @127.0.0.1 -p 5335

; <<>> DiG 9.18.1-1ubuntu1.2-Ubuntu <<>> fail01.dnssec.works @127.0.0.1 -p 5335 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 23012 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ;; QUESTION SECTION: ;fail01.dnssec.works. IN A

;; Query time: 0 msec ;; SERVER: 127.0.0.1#5335(127.0.0.1) (UDP) ;; WHEN: Sat Dec 17 21:04:43 EST 2022 ;; MSG SIZE rcvd: 48

&&

dig dnssec.works @127.0.0.1 -p 5335

; <<>> DiG 9.18.1-1ubuntu1.2-Ubuntu <<>> dnssec.works @127.0.0.1 -p 5335 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52638 ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ;; QUESTION SECTION: ;dnssec.works. IN A

;; ANSWER SECTION: dnssec.works. 3592 IN A 5.45.107.88

;; Query time: 0 msec ;; SERVER: 127.0.0.1#5335(127.0.0.1) (UDP) ;; WHEN: Sat Dec 17 21:04:48 EST 2022 ;; MSG SIZE rcvd: 57

---

So if i understand everything should be fine. I also follow his steps.

And I also read somewhere a way to test on the web. use this link to test your setup!. https://d3ward.github.io/toolz/adblock.html

Hope it help... since I have the same issue.