DNSSEC doesn't work with local-unbound

F

frankit60

Why doesn't DNSSEC work with local-unbound?
How do I fix it? Does anyone have an idea?
Thanks in advance
Franco


Code: 
#
# cat /var/unbound/forward.conf
# This file was generated by local-unbound-setup.
# Modifications will be overwritten.
forward-zone:
    name: .
    forward-addr: 8.8.8.8
    forward-addr: 192.168.1.211
    forward-addr: 1.1.1.1
#
#
# drill -S FreeBSD.org @192.168.1.211
;; Number of trusted keys: 2
;; Chasing: freebsd.org. A

DNSSEC Trust tree:
FreeBSD.org. (A)
|---freebsd.org. (DNSKEY keytag: 55789 alg: 8 flags: 256)
    |---freebsd.org. (DNSKEY keytag: 33175 alg: 8 flags: 257)
    |---freebsd.org. (DS keytag: 33175 digest type: 2)
        |---org. (DNSKEY keytag: 25488 alg: 8 flags: 256)
            |---org. (DNSKEY keytag: 26974 alg: 8 flags: 257)
            |---org. (DS keytag: 26974 digest type: 2)
                |---. (DNSKEY keytag: 57780 alg: 8 flags: 256)
                    |---. (DNSKEY keytag: 20326 alg: 8 flags: 257)
;; Chase successful
#
#
# drill -S FreeBSD.org @192.168.1.1
;; Number of trusted keys: 2
;; Chasing: freebsd.org. A

DNSSEC Trust tree:
FreeBSD.org. (A)
|---freebsd.org. (DNSKEY keytag: 55789 alg: 8 flags: 256)
    |---freebsd.org. (DNSKEY keytag: 33175 alg: 8 flags: 257)
    |---freebsd.org. (DS keytag: 33175 digest type: 2)
        |---org. (DNSKEY keytag: 25488 alg: 8 flags: 256)
            |---org. (DNSKEY keytag: 26974 alg: 8 flags: 257)
            |---org. (DS keytag: 26974 digest type: 2)
                |---. (DNSKEY keytag: 57780 alg: 8 flags: 256)
                    |---. (DNSKEY keytag: 20326 alg: 8 flags: 257)
;; Chase successful
#
#
# drill -S FreeBSD.org @127.0.0.1
;; Number of trusted keys: 2
;; Chasing: freebsd.org. A

DNSSEC Trust tree:
FreeBSD.org. (A)
|---freebsd.org. (DNSKEY keytag: 55789 alg: 8 flags: 256)
    |---freebsd.org. (DNSKEY keytag: 33175 alg: 8 flags: 257)
    |---freebsd.org. (DS keytag: 33175 digest type: 2)
No trusted keys found in tree: first error was: No DNSSEC public key(s)
;; Chase failed.
#
#
 
I made a tutorial on setting up Unbound with dnscrypt proxy and quad 9

dont know if that helps

NapoleonWils0n

Thread 'unbound dns server with dnscrypt-proxy and quad9 on Freebsd'


Setting up the unbound dns server with dnscrypt-proxty and quad9 dns resolver on Freebsd

Quad9 is a free service that replaces your default ISP or enterprise Domain Name Server (DNS) configuration.

Quad9 blocks lookups of malicious host names from an up-to-the-minute list of threats. The Quad9 DNS serviceis operated by the Swiss-based Quad9 Foundation, whose mission is to provide a safer and more robust Internet for everyone.

I also cover setting up a split openvpn route using fibs that allows you to send command line or gui application over the vpn or your regular...
 
I get the same result with local-ubound, using cloudflare.

# cat /var/unbound/forward.conf
# This file was generated by local-unbound-setup.
# Modifications will be overwritten.
forward-zone:
name: .
forward-tls-upstream: yes
forward-addr: 1.1.1.1@853#cloudflare-dns.com
forward-addr: 1.0.0.1@853#cloudflare-dns.com

Now, Cloudflare's browser security check here https://www.cloudflare.com/ssl/encrypted-sni/ passes:-
cloudflare-check.jpg
Which gives me an initial impression that DNSSEC is working. DoH is off in the firefox settings.

However, using two similar drill commands gives me the same result as the OP.

# drill -S FreeBSD.org @1.1.1.1
;; Number of trusted keys: 2
;; Chasing: freebsd.org. A


DNSSEC Trust tree:
FreeBSD.org. (A)
|---freebsd.org. (DNSKEY keytag: 849 alg: 8 flags: 256)
|---freebsd.org. (DNSKEY keytag: 33175 alg: 8 flags: 257)
|---freebsd.org. (DS keytag: 33175 digest type: 2)
|---org. (DNSKEY keytag: 25488 alg: 8 flags: 256)
|---org. (DNSKEY keytag: 26974 alg: 8 flags: 257)
|---org. (DS keytag: 26974 digest type: 2)
|---. (DNSKEY keytag: 8763 alg: 8 flags: 256)
|---. (DNSKEY keytag: 20326 alg: 8 flags: 257)
;; Chase successful

So, server 1.1.1.1 passes the dnssec chase.

# drill -S FreeBSD.org @127.0.0.1
;; Number of trusted keys: 2
;; Chasing: freebsd.org. A


DNSSEC Trust tree:
FreeBSD.org. (A)
|---freebsd.org. (DNSKEY keytag: 849 alg: 8 flags: 256)
|---freebsd.org. (DNSKEY keytag: 33175 alg: 8 flags: 257)
|---freebsd.org. (DS keytag: 33175 digest type: 2)
No trusted keys found in tree: first error was: No DNSSEC public key(s)
;; Chase failed.

But the chase fails using local-unbound, listening on loopback.

I don't know enough about the significance of this finding to comment further, but I get the same result.
 
Another thing I noticed. From this page https://developers.cloudflare.com/dns/dnssec/troubleshooting/

# dig www.cloudflare.com +dnssec

; <<>> DiG 9.20.29 <<>> www.cloudflare.com +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5125
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;www.cloudflare.com. IN A

;; ANSWER SECTION:
www.cloudflare.com. 149 IN A 104.16.123.96
www.cloudflare.com. 149 IN A 104.16.124.96
www.cloudflare.com. 149 IN RRSIG A 13 3 300 20261004215848 20261002195848 34505 www.cloudflare.com. ADQmNmogzjHKtNr3a+rxV699pnlyFvCiYs/1u+j9SfFcHVxEZozfNE+X P03fVHn1R9PgFJArd1xKCSa7JwdWag==

;; Query time: 97 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Sat Oct 03 22:01:20 BST 2026
;; MSG SIZE rcvd: 193

I get an RRSIG section in the response, and the 'ad' flag is set - meaning 'authenticated data'.

However, if I use any other name (than cloudflare.com) I do NOT get the RRSIG section and the 'ad' flag is not set.
For example, yahoo.com gives me

# dig www.yahoo.com +dnssec

; <<>> DiG 9.20.29 <<>> www.yahoo.com +dnssec
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1867
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;www.yahoo.com. IN A

;; ANSWER SECTION:
www.yahoo.com. 58 IN CNAME me-ycpi-cf-www.g06.yahoodns.net.
me-ycpi-cf-www.g06.yahoodns.net. 37 IN A 87.248.114.12
me-ycpi-cf-www.g06.yahoodns.net. 37 IN A 87.248.114.11

;; Query time: 132 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Sat Oct 03 22:03:24 BST 2026
;; MSG SIZE rcvd: 119
So the answer section contains no RRSIG section, and the 'ad' flag is not set, ie this is not 'authenticated data'.

In this case, that is a name other than 'www.cloudflare.com', I observe the same behaviour with both 1.1.1.1 and loopback specified as the dns server.

Is this significant? Does this mean that only the IP address returned for the name 'cloudflare.com' is authenticated and the rest are not? Which doesn't seem to make any sense.
 
You must log in or register to reply here.
Back
Top