Maintained by: NLnet Labs

problems with stub-zones

A. Schulze
Mon Aug 15 14:44:39 CEST 2016


we still have an unsolved issue and cannot find a solution. It's still  
the same as ...

   client -> router -> unbound -> router -> nameserver1 + nameserver2

client's /etc/resolv.conf has only one line: "nameserver ${unbound-ip}"

unbound.conf is minimal:

     local-zone: "" transparent
     domain-insecure: ""

     name: ""
     stub-addr: ${nameserver1-ip}
     stub-addr: ${nameserver2-ip}

nameserver1+2 serve using

Everything is fine as long as both nameservers are up.
If one server fail (simple case: host up, nameserver down) client get  
"no servers could be reached" or similar
answers from local stubresolver. A moment later a second query for the  
same name succeed. But again some queries later we observe timeouts or  
no answers again.

With tcpdump on both nameservers I see queries that are immediately  
answers by the running nameserver
if the nameserver is down, I see "ICMP port unreadable" packets back  
to unbound.

I run "watch -n 1 unbound-control dump_infa | grep arpa"
There is a value "delay" in the line of the failed nameserver that  
count down from 30...90 up to zero.

After unbound once learned nameserver1 is down I could ask non-cached  
queries which are answered immediately
Until the delay counter reach 0. Then there is a again the error in  
answering un-cached queries.

it's unbound-1.5.9 including the patch
minimal-responses, qname-minimisation and use-caps-for-id are disabled.