Closed typkrft closed 2 months ago
Hey there, that's a nice report. Is your time set correct? If yes, could you please show the log?
Thank you.
Thank you for the assist. The time appears to be correct in the container and the host. Expected output on host for date
and timestamps in unbound.log
. Verbosity is default currently.
unbound.log
Aug 21 10:37:11 unbound[7:0] notice: init module 0: validator
Aug 21 10:37:11 unbound[7:0] notice: init module 1: iterator
Aug 21 10:37:11 unbound[7:0] info: start of service (unbound 1.21.0).
Aug 21 10:38:26 unbound[7:0] error: SERVFAIL <minisforum.com. A IN>: exceeded the maximum number of sends
Aug 21 10:55:05 unbound[7:0] error: SERVFAIL <minisforum.com. A IN>: exceeded the maximum number of sends
Aug 21 10:56:49 unbound[7:0] error: SERVFAIL <minisforum.com. A IN>: exceeded the maximum number of sends
Aug 21 11:02:40 unbound[7:0] info: service stopped (unbound 1.21.0).
Aug 21 11:02:40 unbound[7:0] info: server stats for thread 0: 14 queries, 2 answers from cache, 12 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Aug 21 11:02:40 unbound[7:0] info: server stats for thread 0: requestlist max 1 avg 0.75 exceeded 12 jostled 0
Aug 21 11:02:40 unbound[7:0] notice: init module 0: validator
Aug 21 11:02:40 unbound[7:0] notice: init module 1: iterator
Aug 21 11:02:40 unbound[7:0] info: start of service (unbound 1.21.0).
Aug 21 11:03:15 unbound[7:0] error: SERVFAIL <minisforum.com. A IN>: exceeded the maximum number of sends
Aug 21 12:14:26 unbound[7:0] info: service stopped (unbound 1.21.0).
Aug 21 12:14:26 unbound[7:0] info: server stats for thread 0: 4 queries, 1 answers from cache, 3 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Aug 21 12:14:26 unbound[7:0] info: server stats for thread 0: requestlist max 1 avg 0.666667 exceeded 3 jostled 0
Aug 21 12:14:27 unbound[7:0] notice: init module 0: validator
Aug 21 12:14:27 unbound[7:0] notice: init module 1: iterator
Aug 21 12:14:27 unbound[7:0] info: start of service (unbound 1.21.0).
Aug 21 12:14:55 unbound[7:0] error: SERVFAIL <minisforum.com. A IN>: exceeded the maximum number of sends
Aug 21 12:23:04 unbound[7:0] info: service stopped (unbound 1.21.0).
Aug 21 12:23:04 unbound[7:0] info: server stats for thread 0: 3 queries, 0 answers from cache, 3 recursions, 0 prefetch, 0 rejected by ip ratelimiting
Aug 21 12:23:04 unbound[7:0] info: server stats for thread 0: requestlist max 1 avg 0.666667 exceeded 3 jostled 0
Aug 21 12:23:05 unbound[7:0] notice: init module 0: validator
Aug 21 12:23:05 unbound[7:0] notice: init module 1: iterator
Aug 21 12:23:05 unbound[7:0] info: start of service (unbound 1.21.0).
Sure! :)
Please ramp up the log verbosity to 5, try ro resolve the domain and post the results. Please don't forget to reset the verbosity to 1 again afterwards.
Copy that!
I wrapped the log to maintain readability, I hope you don't mind.
Aug 21 14:52:25 unbound[8:0] info: sending query: minisforum.com. A IN
Aug 21 14:52:25 unbound[8:0] debug: sending to target: <minisforum.com.> 47.118.199.206#53
Aug 21 14:52:25 unbound[8:0] debug: dnssec status: not expected
Where did you define your local zone in your unbound.conf
?
Edit: example local zone
No problem, I should have wrapped the log myself. I was trying to understand the dnssec status message. I have not set any local zones. And I'm trying to wrap my head around exactly what it is. Sorry, completely ignorant about DNS past a surface level understanding. My assumption was that I just needed to set the access control and private ranges.
I've uncommented all of the local-zones just for testing added my local and docker networks to access-control.
Current Config just in case I'm not configuring it correctly
Logs
No problem, your styling is great!
You didn't configure your home lan's domain in the zone:
server:
local-zone: "yourlocal.domain." nodefault
local-zone: "yourlocal.domain." nodefault
...
This ain't the root cause for that unexpexted dnssec status I guess but having everything fine is not too bad.
Please try the following changes in your unbound.conf
:
root-hints
outgoing-interface
with your unbound's IPv4 adressdo-not-query-localhost: no
interface: 127.0.0.1@5353
and interface: YOURUNBOUNDIP@5353
Are there network issues somehow? What docker host do you use? Bare metal or virtualized?
Is it working with our default unbound.conf
?
Thanks.
So I believe I found the culprit but I still don't quite understand how it was resolving from inside the container. I had a number of GEO IP blocks setup in my Unifi router, removing them seems to have have resolved the issue. The other possibility is that I just borked up your configuration badly, though I had thought I made pretty minimal edits initially, currently using the stock with 0 edits.
This issue also occurred using this unboundtest.com config in addition to other unbound docker containers, so it lead me to believe it was my network.
From one rando on the internet to another I want to sincerely thank you for your assistance through this.
Thank you, I'm glad it works for you. I had some rules blocking google and such by ASN and Unbound started to behave weird too. It is the only host which bypasses ASN and Geoblock.
Cheers!
Describe the bug It seems that certain domains do not resolve. For example
minisforum.com
. If i exec into the container and drill I get the expected record. But if I dig on the local host or remotely it times out. Other domains do resolve.To Reproduce
unbound.conf - primarily the default. I've removed the comments here to keep things concise, but the structure of the original file in use is intact. I've added the logfile and includes but there is nothing else actually included
docker-compose.yml
sudo docker exec unbound drill minisforum.com
drill record
from localhost
sudo lsof -i -P
dig -p 5353 minisforum.com @0.0.0.0
For reference
Expected behavior Resolve the domain
Please complete the following information:
Additional context n/a