Unbound NXDOMAIN response for Query Forwarding domain after 6 hours.

[db9]

I have an internal DNS zone domain1.lan (local), domain2.net (public registred, split DNS) and reverse zones (192.168.0.0) authoritatively served by a BIND (port 53530) instance on my network. OPNsense's Unbound DNS Resolver (port 53) is configured with a Query Forwarding to forward domain1.lan and domain2.net queries to that BIND server. After reload of Unbound queries for domain1.lan and domain2.net succeed.

After around 6 hours queries for hosts in the zone domain1.lan start returning NXDOMAIN even though BIND itself is healthy and would answer correctly on port 53530. Queries for hosts in domain2.net (and the reverse zone) are not impacted. After reload of Unbound queries for domain1.lan succeed again for a period of 6 hours (refresh timer 21600?).

If i shutdown bind and query for hosts in zone domain1.lan I receive DNS request first timed out and second SERVVAIL, NOT NXDOMAIN.
Registration of DHCP in DNS is disabled.

It looks like related to Unbound DNS Query Forwarding unreliable #7639
https://github.com/opnsense/core/issues/7639
https://github.com/opnsense/core/issues/9736

OPNsense version: 26.7
Issue noticed starting: 26.1.11 (around last 2 weeks)

Domain specified in OPNsense > system: domain1.lan
Domain specified for DHCP clients > domain1.lan
Zone values domain1.lan / domain2.net: TTL 86400, refresh 21600 (default)
Zone values domain1.lan / domain2.net: Allow query (ACL localhost)

No changes have been done to the configuration to be knowledge (added a A/PTR record) that could explain this behaviour and worked correctly for years.

[db9]

The workaround for the NXDOMAIN issue is to disable Query Forwarding in the GUI for domain1.lan.

A) Add file /var/unbound/etc/local.conf

server:
  domain-insecure: "domain1.lan"
  private-domain: "domain1.lan"

forward-zone:
  name: "domain1.lan"
  forward-addr: 127.0.0.1@53530
  forward-no-cache: yes

B) Restart Unbound service.

Could it be something with forward-no-cache setting difference for the GUI or CLI?

[nero355]

OPNsense's Unbound DNS Resolver (port 53) is configured with a Query Forwarding to forward domain1.lan and domain2.net queries to that BIND server.

What is currently your complete DNS flow ?


Would it be an option for you to change your DNS flow to :

Clients => DNSmasqd => BIND => Unbound


I always feel like the whole Clients directly talking to Unbound setup thing is sub-optimal for a lot of people...

[cinergi]

For me, the following post resolved this exact issue:
https://forum.opnsense.org/index.php?msg=260627

Except there is no need for a custom configuration file, since the referenced "Harden Below NXDOMAIN" option is now available directly in the GUI.