Local DNS problem after update core 153

tikok974 · 11 February 2021 10:40

I have something strange going on in Unbound since my last Ipfire update with core update 153.
For example I can’t resolve the ipfire.org domain but also other domains!
Here is the error message I have in the logs

...
Feb  9 23:54:53 myipfire unbound: [1731:0] info: validation failure <time-a.timefreq.bldrdoc.gov. 
AAAA IN>: key for validation bldrdoc.gov. is marked as invalid
Feb  9 23:54:53 myipfire unbound: [1731:0] info: validation failure <time-b.timefreq.bldrdoc.gov. 
AAAA IN>: key for validation bldrdoc.gov. is marked as invalid
...
Feb  9 23:58:13 myipfire unbound: [2596:0] info: validation failure <45.143.166.83.in-addr.arpa. PTR IN>: key for validation in-addr.arpa. is marked as invalid
Feb  9 23:58:14 myipfire unbound: [2596:0] info: validation failure <www.ipfire.org. A IN>: key for validation ipfire.org. is marked as invalid
...
Feb  9 23:55:49 myipfire unbound: [2596:0] info: validation failure <api.met.no. A IN>: No DNSKEY record from 103.247.36.9 for key met.no. while building chain of trust
Feb  9 23:55:49 myipfire unbound: [2596:0] info: validation failure <api.met.no. AAAA IN>: No DNSKEY record from 103.247.36.9 for key met.no. while building chain of trust
...
Feb  9 23:56:02 myipfire unbound: [2596:0] info: validation failure <195.195.97.37.in-addr.arpa. PTR IN>: key for validation in-addr.arpa. is marked as invalid
Feb  9 23:56:03 myipfire unbound: [2596:0] info: validation failure <44.143.166.83.in-addr.arpa. PTR IN>: No DNSKEY record from 172.14.15.16 for key in-addr.arpa. while 
...
Feb  9 23:56:04 myipfire unbound: [2596:0] info: validation failure <www.ipfire.org. A IN>: No DNSKEY record from 103.247.37.9 for key ipfire.org. while building chain of trust
Feb  9 23:56:04 myipfire unbound: [2596:0] info: validation failure <ipfire.org. DNSKEY IN>: No DNSKEY record from 103.247.37.9 for key ipfire.org. while building chain of trust
...

I have Ipfire installed on 3 sites and I have the same problem on all 3 sites

Does anyone have the same worries ?
Is there a bug with Unbound ?

Thanks

jon · 11 February 2021 17:42

Please add a screenshot of your DNS settings (DNS Servers and DNS Configuration) at menu Network > Domain Name System

tikok974 · 12 February 2021 08:22

Hi Jon,
Thank for your answer
Here is my screenshot

Many thanks

jon · 12 February 2021 18:03

Looks like a few Reverse lookup failed type errors, eh?

Let’s try a few things:

Disable all of the DNS in your list - just as a test
Add a Quad9 DNS server @ 9.9.9.9
- this is the DNS server I use so I know it works!
- this is just for testing, you can change later
Change the Protocol for DNS queries from UDP to TLS. And click Save

Now try the domains that did not resolve. Does ipfire.org work OK?

EDIT: added image of my setup

tikok974 · 15 February 2021 09:32

Thanks Jon for your answer.
My firewalls are in production…I will have to check this out of working hours.

I’ll keep you informed…thanks again

tikok974 · 24 February 2021 13:41

Hi Jon,

I was finally able to have a little time to do the above test
With the Protocol for DNS queries field set to “TLS”, if I enter the DNS of Quad9…no problem, it works fine on these DNS.
On the other hand for the DNS of my DNS provider named DNSFilter, only UDP and TCP works !
look at my capture bellow

The problem is that if I disable Quad9’s DNS, I get the errors I described when I opened this post in the firewall log and the sites with the ipfire.org domain or other sites don’t work !
So…is there anything to do on Ipfire or should I contact DNSFilter support ?
Thanks

bbitsch · 24 February 2021 13:48

If DNSFilter doesn’t provide DNS over TLS, you cannot change this in IPFire.

tikok974 · 24 February 2021 13:51

What about the problem I described in my first post…is it possible that some domains (such as ipfire.org) don’t accept not to be contacted via anything other than TLS ?

There is a link at DNSFilter that talks about TLS:

https://docs.dnsfilter.com/docs/dns-over-tls

Apparently I would have to put this information

ssl-upstream: yes
name: "."
forward-addr: 103.247.36.36@853
forward-addr: 103.247.37.37@853

…in a Unbound conf file.

how can I make this setting in Unbound without it being rewritten by Ipfire?

Thanks

jon · 24 February 2021 18:55

The above is bad.

Do this instead → Add a new DNS server and then Save this:

bbitsch · 24 February 2021 19:51

This doesn’t help!
dnsfilter does not support TLS.

jon · 24 February 2021 23:50

Ugh! It is suppose to!

anon42188109 · 25 February 2021 00:11

But … dig +dnssec dns1.dnsfilter.com does not provide the ad flag. Why?

dig +dnssec dns1.dnsfilter.com

; <<>> DiG 9.11.3-1ubuntu1.14-Ubuntu <<>> +dnssec dns1.dnsfilter.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45288
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1232
;; QUESTION SECTION:
;dns1.dnsfilter.com.		IN	A

;; ANSWER SECTION:
dns1.dnsfilter.com.	20960	IN	A	103.247.36.36

jon · 25 February 2021 00:14

@tikok974 - time to contact dnsfilter.com and ask them why…

tikok974 · 25 February 2021 08:36

Thank you all for your answers

@jon, I had already set the DNSFilter addresses correctly in the interface (as shown in my screenshot) but this did not change the problem.

I have created a ticket at DNSFilter and am waiting for their response.

I sent them back to our discussion here so they have all the details.
We’ll wait for their answer…I’ll keep you posted.

Thanks

bbitsch · 25 February 2021 09:22

I just checkerd with both server IPs/host names.
Both with error.