Ftl: Servfail/bogus with DNSSEC and local unbound TLD

[walter-exit]

In raising this issue, I confirm the following (please check boxes, eg [X]) Failure to fill the template will close your issue:

• [X] I have read and understood the contributors guide.
• [X] The issue I am reporting can be replicated
• [X] The issue I am reporting isn't a duplicate

How familiar are you with the codebase?:

1

---

[BUG | ISSUE] Expected Behaviour:
To skip DNSSEC validation of local configured TLD

[BUG | ISSUE] Actual Behaviour:
Query log shows the DNSSEC validation is performed, with "BOGUS" as a result.

[BUG | ISSUE] Steps to reproduce:

1. As shown in the guide in your blog; install unbound and have it inbetween pihole and the root servers.
2. Configure unbound to serve a local TLD (see below)
3. Turn on DNSSEC in pihole
4. Visit a domain with the local TLD.

Extra hints:

• When DNSSEC is disabled, the domains using the local TLD perform well.
• Using dig, pihole returns SERVFAIL while unbound returns a proper A record as expected

Log file output [if available]

`Version information:

Pi-hole Version vDev (FTLDNS, v3.3.1-369-g169a428)
Web Interface Version vDev (FTLDNS, v3.3-238-g8c7521f)
FTL Version vDev (FTLDNS, vDev-3e40158)

Relevant unbound config parts:

unblock-lan-zones: no

-- The insecure-lan-zones option disables validation for
-- these zones, as if they were all listed as domain-insecure.
insecure-lan-zones: yes

private-domain: "mytld"
local-zone: "mytld." static

-- Disable DNSSEC for the local domain
domain-insecure: "mytld"

local-data: "webserver.mytld IN A 192.168.1.100"`

Device specifics

Hardware Type: local linux server (a big one, no rpi)
OS: mint 18.1

_This template was created based on the work of udemy-dl._

[AzureMarker]

This is most likely a dnsmasq bug, as we do not do anything different in regards to handling DNSSEC. Have you contacted Simon Kelley about this?

[walter-exit]

Hi Mark. I had not, yet. But I have now. Hopefully Simon can help me with this further.

I referenced this issue from the DNSMasq issue:
https://github.com/imp/dnsmasq/issues/9
It would be most appreciated if this ticket could keep existing, although, here, with a closed status perhaps?

[DL6ER]

@walter-exit The repository you submitted your issue report appears to be an unmaintained / passive clone of the official repository. It is highly unlikely that anyone will see it there. You should contact [email protected] with this issue.

I will close this issue here as you suggested.

[walter-exit]

My apologies for commenting here again. I actually like it when I search for something online, for a conversation to be complete instead of half, so in the spirit of finishing the "custom TLD" fix I'd like to add..

Simon Kelley of DNSMasq was very kind and helped me by explaining..

(..) as far as dnsmasq is concerned, any answers in the local TLD
cannot be proven as valid, since they're unsigned, and it cannot be
proven that the local TLD is unsigned, since there's no trust path from
the root that proves that. The BOGUS reply from dnsmasq is therefore quite correct.

THe fix for this is to tell dnsmasq that the local TLD is NOT DNSSEC
signed. You can do this by adding the following to the dnsmasq config:

server=/.mytld/{address of unbound server, like: 127.0.0.1#5353}

Simon then further explained..

Check the logs that dnsmasq writes when it starts up, you should see
something like

dnsmasq: using nameserver 127.0.0.1#5353 for domain mytld (no DNSSEC)
dnsmasq: using nameserver 127.0.0.1#5353

If not, then you've not edited the correct file, or not restarted dnsmasq.

I run Pi-hole and unbound when it comes to DNS. Nothing else. Not even DNSMasq. This works as a charm in day to day life. I suppose this is because Pi-hole FTL has DNSMasq onboard if I understand correctly.

Now, this makes me wonder, where exactly can I add the changes that Simon proposed? And where are the logs? Where does Pi-hole FTL put these "DNSMasq" items?

[AzureMarker]

v3.3 still has dnsmasq separate from FTL. v4.0 (FTLDNS) just combines FTL and dnsmasq, so you are still using dnsmasq and all the configs will still work correctly. You can simply add those changes to a new config file under /etc/dnsmasq.d. The dnsmasq log is located at /var/log/pihole.log

[walter-exit]

Thank you Mark.

By creating a file like "/etc/dnsmasq.d/02-mytld.conf" and putting in there:

server=/.mytld/127.0.0.1#5353

.. and then running "pihole restartdns", followed by some dns cache clearing on my hosts, it turns out it works like a charm now.

I was unable to find the texts that Simon told me about in the log. But the real test is of course just visiting. The domains work. They show up in the Pi-hole query log as successful DNS lookups, no longer BOGUS.

Once again, thanks to @DL6ER, Simon Kelley, @Mcat12

Much appreciated guys.