Problems with unbound

[Trond Endrestøl]

On Tue, 15 Mar 2016 12:28+0100, Andrea Brancatelli wrote:

> Hello everybody, 
> 
> we're suddenly having problems with unbound on almost all of our servers
> and I cannot really understand why. 
> 
> To make a long story short, we use this forward.conf: 
> 
> root at dbengine-ent-rm-01:/var/unbound # cat /etc/unbound/forward.conf
> # This file was generated by local-unbound-setup.
> # Modifications will be overwritten.
> forward-zone:
> name: .
> forward-addr: 8.8.8.8
> forward-addr: 8.8.4.4 
> 
> Enabling this: 
> 
>  auto-trust-anchor-file: /var/unbound/root.key 
> 
> in /etc/unbound/unbound.conf gives me this: 
> 
> root at dbengine-ent-rm-01:/var/unbound # host update.freebsd.org
> ;; connection timed out; no servers could be reached 
> 
> simply disabling that line gives me this: 
> 
> root at dbengine-ent-rm-01:/var/unbound # host update.freebsd.org
> update.freebsd.org is an alias for update5.freebsd.org.
> update5.freebsd.org has address 204.9.55.80
> update5.freebsd.org has IPv6 address 2001:4978:1:420::cc09:3750
> update5.freebsd.org mail is handled by 0 . 
> 
> What's going on? 

There's at least two possibilities:

1. Your ISP limits the use of DNS, in particular when DNSSEC is 
involved, or

2. The Google DNS resolvers doesn't support DNSSEC.

I haven't verified the latter, but I would guess Google are competent 
enough to allow DNSSEC.

> root at dbengine-ent-rm-01:/var/unbound # freebsd-version
> 10.2-RELEASE-p13 
> 
> Thanks. 

-- 
+-------------------------------+------------------------------------+
| Vennlig hilsen,               | Best regards,                      |
| Trond Endrestøl,              | Trond Endrestøl,                   |
| IT-ansvarlig,                 | System administrator,              |
| Fagskolen Innlandet,          | Gjøvik Technical College, Norway,  |
| tlf. mob.   952 62 567,       | Cellular...: +47 952 62 567,       |
| sentralbord 61 14 54 00.      | Switchboard: +47 61 14 54 00.      |
+-------------------------------+------------------------------------+