{{tag>Brouillon DNS Resolveur CA}} # Notes serveur DNS Unbound Voir : * https://nlnetlabs.nl/documentation/unbound/unbound.conf/ * https://github.com/iusrepo/unbound1/blob/main/unbound.conf Voir aussi : * [CoreDNS](https://coredns.io/) (cncf.io) Exemple sur RedHat Fix Unbound is very slow to start `/etc/sysconfig/unbound` ~~~bash DISABLE_UNBOUND_ANCHOR=yes ~~~ ## Conf Unbound en resolveur avec Cache DNS `/etc/unbound/unbound.conf` ~~~yaml server: #verbosity: 1 #use-syslog: no #module-config: "subnetcache validator iterator" interface: 127.0.0.53 #interface: ::0 #prefer-ip4: yes #prefer-ip6: no do-ip4: yes do-ip6: no #do-tcp: yes access-control: 127.0.0.0/8 allow #cache-min-ttl: 3600 #cache-max-ttl: 86400 cache-max-negative-ttl: 1 #prefetch: yes #serve-expired: yes #serve-expired-ttl: 14400 #qname-minimisation: yes # Default yes #minimal-responses: yes # Default yes #rrset-roundrobin: yes # Default yes forward-zone: name: "." forward-addr: 8.8.8.8 forward-addr: 8.8.4.4 ~~~ ~~~bash unbound-checkconf systemctl enable --now unbound.service ~~~ ## Conf autres no-aaaa Voir : https://github.com/berstend/unbound-no-aaaa/tree/master/etc/unbound ## Administration Source : https://gist.github.com/f9n/3c4453489820f150c81bdf2f1ccd9516 Verify configuration ~~~bash unbound-checkconf ~~~ Unbound Status ~~~bash unbound-control status ~~~ List Forwards ~~~bash unbound-control list_forwards ~~~ Lookup on Cache ~~~bash unbound-control lookup youtube.com ~~~ Dump Cache ~~~bash unbound-control dump_cache > dns-cache.txt ~~~ Restore Cache ~~~bash unbound-control load_cache < dns-cache.txt ~~~ Flush Cache ~~~bash # Flush Specific Host unbound-control flush www.youtube.com # Flush everything unbound-control flush_zone . ~~~ ### Diag Increase logged verbosity only runtime ~~~bash unbound-control verbosity 3 ~~~ Print operational statistics numbers. ~~~bash unbound-control stats ~~~ Print used root server hints ~~~bash unbound-control list_stubs ~~~ Print contacted servers details. Useful to read how fast they respond and what features they support. ~~~bash unbound-control dump_infra ~~~ Test DNSSEC status of host ~~~bash unbound-host -rv example.net -D ~~~ ## Autres Essaie de surcharger la conf /etc/unbound/unbound.conf (RedHat) `/etc/unbound/cond.d/common.conf` ~~~yaml server: #trust-anchor-file: "" #auto-trust-anchor-file: "" #trust-anchor: "" #trusted-keys-file: "" #val-permissive-mode: yes #prefetch: no #disable-dnssec-lame-check: no #harden-dnssec-stripped: no #harden-glue: no #harden-below-nxdomain: no #harden-referral-path: no ~~~