Unbound Not Actually Blocking ANYTTHING, But Resolves No Problem

[ticker]

OPNsense 26.7.3_11 (amd64)
Everything was installed and configured using the GUI.
It has been running for over a year, I don't recall this being an issue previously, but I haven't looked at the machine beyond updating in a few months and I just noticed it this week.

I am having an issue where the Unbound DNS blocklist appears to download and load successfully, but domains are not actually being blocked for LAN clients.
It does seem to be resolving my domains without issue and properly. So I don't believe it is an issue with Unbound itself not being used, however an issue with Unblound actually blocking.
I could be wrong, but I believe it used to work without issue, I haven't messed with Opnsense in months. Just noticed this.

The Blocklist page reports approximately 1,327,249 entries loaded. I have several blocklists configured. I know that's a lot, and could cause false positives, don't really care.

As a test, ibrainer.net is known to be present in that list. I also manually added ibrainer.net under Blocklist Domains, but it continues to resolve normally.
This domain was just a random domain I chose in one of the blocklists to test with.

Testing:

From a Windows LAN client, I queried the firewall directly:
The client is definitely querying Unbound on OPNsense, but the real DNS records are returned.

Unbound Reporting shows the queries as Pass rather than Blocked. For example:

2026-09-11 03:08:58
[REDACTED CLIENT]
A
ibrainer.net.
Pass
Recursion
NOERROR
84ms
3600

2026-09-11 03:08:58
[REDACTED CLIENT]
AAAA
ibrainer.net.
Pass
Recursion
NOERROR
6ms
3600


After subsequent queries, they also appear as:

ibrainer.net.
Pass
Cache
NOERROR

I also tested metrics.icloud.com, which I manually added to Blocklist Domains, and it still resolves normally.

Other troubleshooting performed/settings statuses:

Confirmed Unbound DNS is enabled.
Confirmed all required LAN/VLAN interfaces are selected under Unbound.
Source Net(s) is empty/default.
Destination Address is empty/default.
Return NXDOMAIN is unchecked.
Cache TTL is set to 72000.
Unbound Access Lists are empty.
Restarted Unbound with Flush Cache on Restart enabled.
Flushed the Windows DNS cache with ipconfig /flushdns.
Retested using the firewall address directly (192.168.1.1).
Confirmed the blocklist downloads and reports approximately 1.33 million entries under Reporting > Unbound DNS.
Added ibrainer.net manually to Blocklist Domains as a direct test.
The built-in blocklist tester returns:
{"status":"error"}

I also tried fresh resetting the reporting. Shows 0 under blocked, while resolved is slowly going up.

I also tried manually clicking block on the ibrainer.net domain in the Reporting > Unbound DNS and it does toggle the icon so I can "allow it" after, so it seems to be "blocking it"... however it doens't actually appear to be blocking it.


The main issue appears to be that the blocklists are being downloaded/parsed, but the resulting DNSBL rules are not being applied to client queries. Fresh queries are still reported as Pass / Recursion / NOERROR instead of being blocked. Domains are resolving normally, my DNS is fine. I have my whole network set to use Unbound for DNS resolution. It just seems like absolutely NOTHING is being blocked for some reason.

[DEC740airp414user]

Reporting - unbound dns.   Is that giving you stats of anything being blocked?

I recently turned off reporting but I always have data there

[ticker]

Reporting - unbound dns.   Is that giving you stats of anything being blocked?

No, it remains at 0.
I even tried resetting the stats in there.

It shows domains are resolving. But 0 is blocked.

In the Reporting > Unbound page, I actually also tried clicking the GUI button for a domain that's allowed, to blocklist it.
The button DOES change the little block button-from "block" to "allow", however it does not add to the "Blocked" counter, nor does it show blocked in the list, nor in details.. and I can still resolve it from my machine. All even after restarting the Unbound service.

[lmoore]

The built-in blocklist tester returns:
{"status":"error"}

This is a clue to your problem. When operating normally it will report as "OK".

Review Unbound log file for problems.

The domain 'metrics.icloud.com' is reported as blocked on my system;

Code Select Expand

{
  "status": "OK",
  "action": "Block",
  "policy": {
    "source_nets": [],
    "address": "0.0.0.0",
    "rcode": 0,
    "description": "Hagezi Multi ULTIMATE - Agressive",
    "id": "cef05142-cb68-4a0f-91cb-af2383e450b4",
    "passlist": ".*localhost$",
    "prio": 3.402823669209385e+38,
    "hidx": 0,
    "bl": "ULTIMATE - Aggressive Blocking",
    "category": "Hagezi Multi - Clean the Internet"
  }
}

[ticker]

The built-in blocklist tester returns:
{"status":"error"}

This is a clue to your problem. When operating normally it will report as "OK".

Review Unbound log file for problems.

I am looking through the logs again, but I'm not seeing much that stands out. I'm not sure why.

I did notice one thing, though. I rebooted the Unbound service and noticed the OPNsense notification dot in the top right of the GUI turned yellow. When I clicked it, it said that one of the lists couldn't be parsed due to a format error. Ok that's a hint.

However.. is it normal that if one or a few lists cannot be parsed due to a format error, it will cause the overall blocklist parsing/update to completely fail? I had assumed Unbound would simply skip the list it couldn't parse and continue processing the other lists, rather than the failure affecting the rest of the blocklists?


For testing, I removed all of my custom-added lists and left only the integrated lists enabled. I applied the changes and restarted the service, and the yellow notification did not come back.

It does seem like things are working better now, at least it's not 0 blocked.. but I'm still not sure if they're working completely. I'm seeing an extremely small number of blocked queries compared to what I remember seeing in the past. I have a handful of devices on my network, including devices that should be generating plenty of questionable/tracking DNS queries simply by being on the network, so I would expect to see significantly more blocked traffic.

For example, I just tried going to ibrainer.net from my phone's web browser. I can reach the site, and it doesn't show up in Unbound Reporting at all. However, I do see my phone's client IP appearing many times in the Unbound reporting, so the phone is definitely generating DNS queries through Unbound. I can also only 2 domains that it did block, and it does mention the blocklist: LIGHT - Relaxed Blocking - Hagezi Multi; which is a good sign.

The confusing part is that I have ibrainer.net manually added under:
Unbound → Blocklists → Blocklist Domains

The Blocklist Tester also confirms that it is being blocked:

{
  "status": "OK",
  "action": "Block",
  "policy": {
    "source_nets": [],
    "address": "0.0.0.0",
    "rcode": 0,
    "description": "Primary Blocklist",
    "id": "ddbb5190-43e0-4d07-89d3-25e95053bbbf",
    "passlist": "",
    "prio": 3.402823669209385e+38,
    "hidx": 0,
    "bl": "Custom"
  }
}


So Unbound clearly knows that ibrainer.net should be blocked, yet I can still access it from the phone.


And I just triple checked, my iPhone is manually configured to use the firewall as its DNS server, so I'm not intentionally using another DNS server. And as mentioned above, I can see plenty of DNS queries from the phone in Unbound Reporting. Furthermore, I had setup Opnsense so all the devices on the network use Unbound by default. So I don't believe it's an issue that the clients simply aren't using it.

One other thing I noticed: if I query a domain, ex: ads.youtube.com without the trailing dot, Windows sometimes ends up querying ads.youtube.com.lan.. If I use the trailing dot, it correctly queries ads.youtube.com.. I don't think that's related, since OPNsense Reporting itself displays normal DNS names with the trailing dot. But just something I noticed that I wansn't sure about. I don't notice this on all the domains, idk.


I'm wondering if there is something else going on with the blocklist generation/loading, because the Blocklist Tester says the domains are blocked, but actual client behavior and the amount of blocked traffic don't seem to match what I would expect at all.

In my initial setup over a year ago and afterwards while I remember it working, Unbound was SIGNIFICANTLY much "noisier", and I saw considerably more blocked queries from the devices on my network. Now I'm seeing basically nothing, even though I have the general blocklists and several HaGeZi/OSID lists enabled.
And a few years before I had Unbound, I had a PiHole and it was just as noisy with blocking. So I know my baseline should be higher.

In the past 40 min I have 20 domains blocked, 3 which were manual inquiries.
That's not even peanuts. So something is still not working properly, but we're moving in the right direction..

[ticker]

Following up from my previous message, I double-checked everything and added a few of my custom blocklists back in.
I am still curious about this?

However.. is it normal that if one or a few lists cannot be parsed due to a format error, it will cause the overall blocklist parsing/update to completely fail? I had assumed Unbound would simply skip the list it couldn't parse and continue processing the other lists, rather than the failure affecting the rest of the blocklists?

Anyways..
I restarted the Unbound service and there was no yellow notification dot. I then rebooted the entire firewall, and again, no yellow dot. Saved everything and left it at that. Just using that as an indicator all my lists are parsing fine now.

I then enabled Flush the Unbound cache on reboot, restarted the service, and reset the Unbound Reporting stats. After that, I restarted the service again, turned Flush the Unbound cache on reboot back off, and restarted the service one more time.

After that I already notice after 1minute, 7 things on the blocklist which weren't even up before. The funny thing is the 7 things it already blocked were from the default lists, not my custom lists. Weird how it wasn't catching them before.

Might be a bit overkill to do all the restarts, but can't hurt.
At this point I'm going to let it sit for a few hours while I go out and see what things look like when I come back.
Edit: 5min later already at 30 blocks.