No DNSSEC support?

adam:ONE®
1

Greetings,

I have set up local-unbound on a self hosted machine, and configured it using local-unbound-setup. This automatically configured my resolver to use the router gateway as a forward zone, and everything works as long as I skip DNSSEC validation.

The requests go through local-unbound, and get forwarded to my router IP and resolve fine. But as soon as I enable it (enabled by default, so I had to manually disable by adding module-config: "iterator" to my local-unbound config file) all requests fail with SERVFAIL.

On my Pfsense I have enabled DNS Resolver, and DNSSEC support is on. From my machine I can do drill google.com @127.0.0.1 and not get an answer. But with the -o cd flag the answer returns. (-o cd means checking disabled)

Unless I’m out to lunch with this?

2

Update: The problem seems to be that local-unbound expects to be able to validate DNSSEC for the domains, but because it’s being forced to use pfsense as the resolver via the dns hijack rules, it is not able to.

Adding module-config: “iterator” does solve that problem.

Strange why it wouldn’t work for domains that were local to the machine like jail.local for example.