Comments (5)
From looking at the logs, it seems that the issue is that Unbound is configured to DNSSEC validate. The .eu DNSKEY is too large to fit in a UDP response. UDP responses work fine, but the TCP response fails with a timeout. This happens again and again, until you give up. Perhaps the firewall is set to allow UDP but not TCP traffic? TCP traffic does not get answers, and this is why the resolution fails, it works but the DNSSEC verification fails to fetch the .eu DNSKEY RRset because it is large and needs to use TCP for transport, and TCP traffic fails with timeout. Unbound tries several of the upstream forwarders that are configured.
from unbound.
Well, disabling DNSSEC validation per this page in the docs does in fact make it work again.
I also tried disabling all rules in iptables and the firewall on my modem, neither seemed to matter. I also have no trouble setting up any other TCP connections, and it seems to be relatively recent development (it started around the beginning of this week). Do you know if there's a reliable way to test if this is a firewall issue of some kind?
from unbound.
Supposedly when Unbound makes a TCP connection, this is very similar to performing a dig +tcp @that_ip_address query_name
. From the same host as where unbound is running. If the option for outgoing interface is set, that would change the outgoing interface for that.
from unbound.
dig +tcp loots.eu @1.1.1.1
works fine. I tried with +dnssec +tpc
to eu
as well, seeing as somehow that would seem be the issue but everything came through fine.
from unbound.
If it works like that then why can Unbound not do it? It is really doing the same thing; unless you use configuration options like outgoing-interface, or socket options, or TLS settings.
from unbound.
Related Issues (20)
- Option for unbound-control list_forwards to list IPv6 only or IPv4 only upsreams
- 在配置EDNS Client Subnet 后部分域名无法获取DNS解析 HOT 9
- There are memory leaks with SIGHUP HOT 6
- [FR] Introduce libunbound-control library for external consumers HOT 2
- [FR] Does latest unbound to supports on Ubuntu 24.04 HOT 1
- Intermittent DNS blocking failure with local-zone and always_nxdomain HOT 23
- [SERVFAIL] Unbound with DoT enabled fails to resolve certain websites HOT 4
- [FR] Managing Cache Deletion and Fallback to Forwarding During Unbound Recursive DNS Failures
- [BUG] Problems to build unbound with nghttp2 and OpenSSL 3.3.0 / 3.2.1 HOT 3
- Unbound 1.20 Cachedb broken? HOT 34
- SHOULD in section 4.2 of RFC 9460 not implemented
- Unbound cache question because I'm confused HOT 2
- Chroot location question HOT 1
- Unbound 1.20 crashes in less than one hour, in libevent HOT 4
- [FR] Clear both in-memory and `cachedb` module cache with `unbound-control flush*` commands HOT 2
- Null pointer dereference issue in function ub_ctx_set_fwd of file libunbound/libunbound.c
- unbound is not friendly enough to support certain non-standard zones. HOT 10
- I think libevent for unbound is broken and cannot be compiled HOT 2
- Unbound anwsers SERVAIL instead of NOERROR HOT 2
- tags from tagged rpz zones are no longer honored after upgrade from 1.19.3 to 1.20.0 HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from unbound.