DNSmasq and Unbound Peacefully Co-Existing?

[spetrillo]

Hello all,

I made the move to DNSmasq for local DNS and DHCP services, with Unbound as my authoritative server that looks at Quad9 on the Internet. Attached is my Dnsmasq config and Unbound config. Am I missing anything in the configs? Lastly I am using the DNSSEC services from Quad9. When I try to hit their URL for this I get back an unable to parse request message. Does this mean I do not have DNSSEC configured correctly?

Thanks,
Steve

[DEC670airp414user]

screen shot 3.  i would turn off DNS within dnsmasq. change listen port to 0.      you also do not need dnssec enabled if using quad 9

i use unbound and it works 100% reliable.

i setup dns over tls for quad 9 or similar products though. 

[spetrillo]

So this brings up an interesting question. If unbound is by nature recursive do I need to forward to another nameserver on the Internet? Is that just an extra step that gets me nothing but log entries of my activity?

[DEC670airp414user]

its personal preference. 

unbound set to not forward should never go down/ have any issues.   it also does not use dns over tls which i prefer to use myself:

if forwarding you are at the mercy of the servers you choose to forward to for privacy and reliability

[spetrillo]

If you use DoT do you just configure the nameservers in that Unbound section and you are good to go? For example the Quad9 DNSSEC IPs?

[DEC670airp414user]

i turn off dnssec:  https://docs.quad9.net/Setup_Guides/Open-Source_Routers/OPNsense_%28Encrypted%29/

[spetrillo]

OK so I turned off DNSSEC on both dnsmasq and Unbound. I configured gthe DoT stuff in Unbound and tested successfully from the OPNsense CLI.

Thank you!

[Stormscape]

screen shot 3.  i would turn off DNS within dnsmasq. change listen port to 0.      you also do not need dnssec enabled if using quad 9

i use unbound and it works 100% reliable.

i setup dns over tls for quad 9 or similar products though. 

Important caveat: You will NOT get name resolution for local DHCP clients if the dnsmasq DNS server is turned off, as Unbound will not read the dnsmasq DHCP client list automatically.

[vimage22]

@DEC670airp414user. Is there a downside to DNSSEC? From google:
"DNSSEC as securing the message content (authenticity)"
"DoT as securing the envelope (privacy/confidentiality)."
Both of these seem like it would be a benefit.

@Stormscape. I do not think your answer is accurate. I use kea for DHCP and unbound.
IPv4 LAN does get local name resolution.
IPv6 LAN gets resolution when a reservation is added after a restart of the unbound service.