[SOLVED] Unbound DNS - certain domains are not being resolved

[csk4l3]

Hi @all,

I have a very weird issue with Unbound. I have two specific domains that Unbound is unable to resolve:

idp.zentral.idp.splitdns.ti-dienste.de
erp.zentral.erp.splitdns.ti-dienste.de

When I query Google, Clouflare or Quad9 directly I do get the correct answer. But when I query 127.0.0.1 I don't get a result. Also worth mentioning that

Code: [Select]

unbound-host idp.zentral.idp.splitdns.ti-dienste.de will return the correct result yet

Code: [Select]

unbound-host -r idp.zentral.idp.splitdns.ti-dienste.de will not.

I asked a friend who's also running OPNsense 23.1 and he's having the same issue. Can anyone else confirm this behavior and better yet provide an explanation or even a fix?

Thx in advance to anyone who takes the time to read this or even respond! 

[Maurice]

Rebind protection. The IP addresses these domains resolve to are in 100.64.0.0/10. This is not publicly routable address space, but "shared address space" used by ISPs for CPEs behind CGNAT. Not sure why one would use such addresses in public DNS.

If you're sure you want this, you can remove that address space from Unbound's list of rebind protection networks.

Cheers
Maurice

[csk4l3]

Hi Maurice,

thx so much for your reply and the explanation. Did not know those addresses weren’t publicly routed. Could I explicitly whitelist those two exceptions or the domain *.splitdns.to-dienste.de to solve the issue. Don’t really feel like messing with Unboud’s rebind protection list.

Cheers mate
Crs

[Maurice]

You can create exceptions for these domains by adding them to Services: Unbound DNS: Advanced: Private Domains.

[csk4l3]

yep that seems to be working. Thx again mate.