Unbound NXDOMAIN response for Query Forwarding domain after 6 hours.

Started by db9, July 20, 2026, 04:10:49 PM

Previous topic - Next topic
I have an internal DNS zone domain1.lan (local), domain2.net (public registred, split DNS) and reverse zones (192.168.0.0) authoritatively served by a BIND (port 53530) instance on my network. OPNsense's Unbound DNS Resolver (port 53) is configured with a Query Forwarding to forward domain1.lan and domain2.net queries to that BIND server. After reload of Unbound queries for domain1.lan and domain2.net succeed.

After around 6 hours queries for hosts in the zone domain1.lan start returning NXDOMAIN even though BIND itself is healthy and would answer correctly on port 53530. Queries for hosts in domain2.net (and the reverse zone) are not impacted. After reload of Unbound queries for domain1.lan succeed again for a period of 6 hours (refresh timer 21600?).

If i shutdown bind and query for hosts in zone domain1.lan I receive DNS request first timed out and second SERVVAIL, NOT NXDOMAIN.
Registration of DHCP in DNS is disabled.

It looks like related to Unbound DNS Query Forwarding unreliable #7639
https://github.com/opnsense/core/issues/7639
https://github.com/opnsense/core/issues/9736

OPNsense version: 26.7
Issue noticed starting: 26.1.11 (around last 2 weeks)

Domain specified in OPNsense > system: domain1.lan
Domain specified for DHCP clients > domain1.lan
Zone values domain1.lan / domain2.net: TTL 86400, refresh 21600 (default)
Zone values domain1.lan / domain2.net: Allow query (ACL localhost)

No changes have been done to the configuration to be knowledge (added a A/PTR record) that could explain this behaviour and worked correctly for years.