mjl-
commented
2 months ago Hi @vipas84, I typically run "apt install unbound unbound-anchor" on a debian machine. Then verify unbound has an "auto-trust-anchor-file" configured, check the localhost nameserver is being used (in /etc/resolv.conf), and run dig NS com. and look for "ad" (authentic data) in the line with "flags".
Some example config snippets below.
The root trust anchors are added by installing unbound/unbound-anchor (on some machines (debian on arm maybe?) I needed to run unbound-anchor -a path/to/root/key):
$ cat /etc/unbound/unbound.conf.d/root-auto-trust-anchor-file.conf
server:
# The following line will configure unbound to perform cryptographic
# DNSSEC validation using the root trust anchor.
auto-trust-anchor-file: "/var/lib/unbound/root.key"Checking that local resolver is used (you may have to be careful that a systemd isn't overwriting /etc/resolv.conf, on debian I would install package openresolv):
~$ cat /etc/resolv.conf
nameserver 127.0.0.1Testing local resolver, the "ad" in the "flags:" indicates dnssec-verification, the "server" line at the bottom shows the local resolver is used:
$ dig NS com.
; <<>> DiG 9.19.21-1+b1-Debian <<>> NS com.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35217
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 13, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;com. IN NS
;; ANSWER SECTION:
com. 86053 IN NS b.gtld-servers.net.
[...]
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Sat Apr 27 08:57:59 CEST 2024
;; MSG SIZE rcvd: 256You can enable logging in unbound to debug:
$ cat /etc/unbound/unbound.conf.d/log.conf
server:
verbosity: 2
log-queries: yesits show-stopper, since emails are regected by gmail and outlook
I'm not so sure your resolver not verifying DNSSEC would be a reason gmail or outlook rejects your email. Why do you think this is causing the issue? Common issues for gmail/outlook to reject are:
- Reverse DNS of your IPs not resolving back to your hostname (the mox admin dns check page will warn about this).
- IP is on blocklist (there's a check during the quickstart, and the admin page has links to a page that checks with many blocklists)
- Domain name was registered very recently (less than 4 weeks ago, but the older a domain the better).
- Something is wrong with the DNS records for your domain (the mox dns check admin page should show these).
In my experience especially the freemail outlook (not enterprise outlook) tends to block messages and blocklist IPs without reason.
RobSlgm
vipas84
is there any step-by-step guide how to fix it with unbound? its show-stopper, since emails are regected by gmail and outlook