Unbound fails to resolve certain domains when going from 1.11 to 1.12

I'm experiencing failure to resolve certain domains after upgrading from unbound 1.11 to 1.12. I have confirmed that switching between these versions has direct impact on the issue. Also disabling DNSSEC validation, by commenting out the `trust-anchor-file` will resolve the problem (at the cost of disabling DNSSEC of course) which makes be believe that this is an DNSSEC issue.

I'm running unbound 1.12 on Arch Linux using the exact config below for both tests on 1.11 and 1.12. The build script used by Arch Linux is available here: https://github.com/archlinux/svntogit-community/blob/packages/unbound/trunk/PKGBUILD

```
server:
        do-daemonize: no

        # logging
        verbosity: 9
        use-syslog: yes
        log-queries: no

        # logs why dnssec validation failed
        val-log-level: 2

        # process chroots itself in /etc/unbound
        #logfile: dnslog.txt

        # root dns config
        root-hints: "/etc/unbound/named.cache"

        # this file will be copied from /etc/trusted-key by the unbound.server
        trust-anchor-file: /etc/unbound/trusted-key.key
        #auto-trust-anchor-file: /etc/unbound/trusted-key.key

        # bind to localhost for dnsmasq to redirect
        do-tcp: no
        do-ip6: no
        access-control: 127.0.0.1/8 allow
        interface: 127.0.0.1
        port: 10053

        # caching
        msg-cache-size: 4m
        msg-cache-slabs: 4

        # security
        hide-identity: no
        hide-version: no
        use-caps-for-id: no
        unwanted-reply-threshold: 10000000

        # misc
        do-not-query-localhost: yes
        prefetch: yes

        # disables mozilla (and google?) dns over https
        local-zone: "use-application-dns.net" static
```

Multiple domains are affected by this issue:

* fedoraproject.org
* unitymedia.de
* a few other that I have no record of (took me a while to realize it's an dns issue)

Below is the log output of unbound 1.12 while trying to resolve the A record of `fedoraproject.org`

```
info: sending query: fedoraproject.org. DNSKEY IN
debug: sending to target: <fedoraproject.org.> 38.145.60.14#53
debug: dnssec status: expected
debug: EDNS lookup known=1 vs=0
debug: serviced query UDP timeout=477 msec
debug: inserted new pending reply id=3ab3
debug: opened UDP if=0 port=21121
debug: comm point start listening 10 (-1 msec)
debug: mesh_run: iterator module exit state is module_wait_reply
info: mesh_run: end 10 recursion states (9 with reply, 0 detached), 9 waiting replies, 0 recursion replies sent, 0 replies dropped, 0 states jostled out
info: 0vRDCD mod2  fedoraproject.org. DNSKEY IN
info: 1RDdc mod1 rep fedoraproject.org. A IN
info: 2RDdc mod1 rep fedoraproject.org. A IN
info: 3RDdc mod1 rep fedoraproject.org. A IN
info: 4RDdc mod1 rep fedoraproject.org. A IN
info: 5RDdc mod1 rep fedoraproject.org. A IN
info: 6RDdc mod1 rep fedoraproject.org. A IN
info: 7RDdc mod1 rep fedoraproject.org. A IN
info: 8RDdc mod1 rep fedoraproject.org. A IN
info: 9RDdc mod1 rep fedoraproject.org. A IN
debug: cache memory msg=67956 rrset=84388 infra=10260 val=68606 subnet=74504
debug: svcd callbacks end
debug: answer cb
debug: Incoming reply id = 3ab3
debug: Incoming reply addr = ip4 38.145.60.14 port 53 (len 16)
debug: lookup size is 1 entries
debug: received udp reply.
debug: udp message[46:0] 3AB3861000010000000000010D6665646F726170726F6A656374036F726700003000010000291000000080000000
debug: outnet handle udp reply
debug: measured roundtrip at 134 msec
debug: initiate TCP query EDNS
debug: close of port 21121
debug: close fd 10
debug: tcp error for address ip4 38.145.60.14 port 53 (len 16)
debug: svcd callbacks start
debug: worker svcd callback for qstate 0x55c28f1745a0
debug: mesh_run: start
debug: iterator[module 2] operate: extstate:module_wait_reply event:module_event_noreply
info: iterator operate: query fedoraproject.org. DNSKEY IN
debug: process_response: new external response event
debug: iter_handle processing q with state QUERY RESPONSE STATE
debug: query response was timeout
debug: iter_handle processing q with state QUERY TARGETS STATE
info: processQueryTargets: fedoraproject.org. DNSKEY IN
debug: processQueryTargets: targetqueries 0, currentqueries 0 sentcount 7
info: DelegationPoint<fedoraproject.org.>: 4 names (0 missing), 6 addrs (6 result, 0 avail) cacheNS
info:   ns05.fedoraproject.org. * A AAAA
info:   ns-iad01.fedoraproject.org. * A
info:   ns02.fedoraproject.org. * A AAAA
info:   ns-iad02.fedoraproject.org. * A
debug:    ip4 38.145.60.14 port 53 (len 16)
debug:    ip6 2610:28:3090:3001:dead:beef:cafe:fed5 port 53 (len 28)
debug:    ip4 152.19.134.139 port 53 (len 16)
debug:    ip4 38.145.60.13 port 53 (len 16)
debug:    ip6 2001:4178:2:1269:dead:beef:cafe:fed5 port 53 (len 28)
debug:    ip4 85.236.55.10 port 53 (len 16)
debug: servselect ip4 38.145.60.14 port 53 (len 16)
debug:    rtt=481
debug: servselect ip4 152.19.134.139 port 53 (len 16)
debug:    rtt=436
debug: servselect ip4 38.145.60.13 port 53 (len 16)
debug:    rtt=459
debug: servselect ip4 85.236.55.10 port 53 (len 16)
debug:    rtt=306
debug: selrtt 306
info: sending query: fedoraproject.org. DNSKEY IN
debug: sending to target: <fedoraproject.org.> 85.236.55.10#53
debug: dnssec status: expected
debug: EDNS lookup known=1 vs=0
debug: serviced query UDP timeout=306 msec
debug: inserted new pending reply id=f118
debug: opened UDP if=0 port=35132
debug: comm point start listening 10 (-1 msec)
debug: mesh_run: iterator module exit state is module_wait_reply
info: mesh_run: end 10 recursion states (9 with reply, 0 detached), 9 waiting replies, 0 recursion replies sent, 0 replies dropped, 0 states jostled out
info: 0vRDCD mod2  fedoraproject.org. DNSKEY IN
info: 1RDdc mod1 rep fedoraproject.org. A IN
info: 2RDdc mod1 rep fedoraproject.org. A IN
info: 3RDdc mod1 rep fedoraproject.org. A IN
info: 4RDdc mod1 rep fedoraproject.org. A IN
info: 5RDdc mod1 rep fedoraproject.org. A IN
info: 6RDdc mod1 rep fedoraproject.org. A IN
info: 7RDdc mod1 rep fedoraproject.org. A IN
info: 8RDdc mod1 rep fedoraproject.org. A IN
info: 9RDdc mod1 rep fedoraproject.org. A IN
debug: cache memory msg=67956 rrset=84388 infra=10260 val=68606 subnet=74504
debug: svcd callbacks end
debug: answer cb
debug: Incoming reply id = f118
debug: Incoming reply addr = ip4 85.236.55.10 port 53 (len 16)
debug: lookup size is 1 entries
debug: received udp reply.
debug: udp message[46:0] F118861000010000000000010D6665646F726170726F6A656374036F726700003000010000291000000080000000
debug: outnet handle udp reply
debug: measured roundtrip at 22 msec
debug: initiate TCP query EDNS
debug: close of port 35132
debug: close fd 10
debug: tcp error for address ip4 85.236.55.10 port 53 (len 16)
debug: svcd callbacks start
debug: worker svcd callback for qstate 0x55c28f1745a0
debug: mesh_run: start
debug: iterator[module 2] operate: extstate:module_wait_reply event:module_event_noreply
info: iterator operate: query fedoraproject.org. DNSKEY IN
debug: process_response: new external response event
debug: iter_handle processing q with state QUERY RESPONSE STATE
debug: query response was timeout
debug: iter_handle processing q with state QUERY TARGETS STATE
info: processQueryTargets: fedoraproject.org. DNSKEY IN
debug: processQueryTargets: targetqueries 0, currentqueries 0 sentcount 8
info: DelegationPoint<fedoraproject.org.>: 4 names (0 missing), 6 addrs (6 result, 0 avail) cacheNS
info:   ns05.fedoraproject.org. * A AAAA
info:   ns-iad01.fedoraproject.org. * A
info:   ns02.fedoraproject.org. * A AAAA
info:   ns-iad02.fedoraproject.org. * A
debug:    ip4 38.145.60.14 port 53 (len 16)
debug:    ip6 2610:28:3090:3001:dead:beef:cafe:fed5 port 53 (len 28)
debug:    ip4 152.19.134.139 port 53 (len 16)
debug:    ip4 38.145.60.13 port 53 (len 16)
debug:    ip6 2001:4178:2:1269:dead:beef:cafe:fed5 port 53 (len 28)
debug:    ip4 85.236.55.10 port 53 (len 16)
debug: servselect ip4 85.236.55.10 port 53 (len 16)
debug:    rtt=252
debug: servselect ip4 38.145.60.13 port 53 (len 16)
debug:    rtt=459
debug: servselect ip4 152.19.134.139 port 53 (len 16)
debug:    rtt=436
debug: servselect ip4 38.145.60.14 port 53 (len 16)
debug:    rtt=481
debug: selrtt 252
info: sending query: fedoraproject.org. DNSKEY IN
debug: sending to target: <fedoraproject.org.> 85.236.55.10#53
debug: dnssec status: expected
debug: EDNS lookup known=1 vs=0
debug: serviced query UDP timeout=252 msec
debug: inserted new pending reply id=cc8f
debug: opened UDP if=0 port=14758
debug: comm point start listening 10 (-1 msec)
debug: mesh_run: iterator module exit state is module_wait_reply
info: mesh_run: end 10 recursion states (9 with reply, 0 detached), 9 waiting replies, 0 recursion replies sent, 0 replies dropped, 0 states jostled out
info: 0vRDCD mod2  fedoraproject.org. DNSKEY IN
info: 1RDdc mod1 rep fedoraproject.org. A IN
info: 2RDdc mod1 rep fedoraproject.org. A IN
info: 3RDdc mod1 rep fedoraproject.org. A IN
info: 4RDdc mod1 rep fedoraproject.org. A IN
info: 5RDdc mod1 rep fedoraproject.org. A IN
info: 6RDdc mod1 rep fedoraproject.org. A IN
info: 7RDdc mod1 rep fedoraproject.org. A IN
info: 8RDdc mod1 rep fedoraproject.org. A IN
info: 9RDdc mod1 rep fedoraproject.org. A IN
debug: cache memory msg=67956 rrset=84388 infra=10260 val=68606 subnet=74504
debug: svcd callbacks end
debug: answer cb
debug: Incoming reply id = cc8f
debug: Incoming reply addr = ip4 85.236.55.10 port 53 (len 16)
debug: lookup size is 1 entries
debug: received udp reply.
debug: udp message[46:0] CC8F861000010000000000010D6665646F726170726F6A656374036F726700003000010000291000000080000000
debug: outnet handle udp reply
debug: measured roundtrip at 22 msec
debug: initiate TCP query EDNS
debug: close of port 14758
debug: close fd 10
```
(The log output seems to repeat a few times in an attempt by unbound to reattempt validation before failing)

Ignore the fact that unbound is running behind an dnsmasq. All testing was done directly on unbound with dnsmasq stopped. I've cross-checked my configuration with multiple sources and have no idea what I am doing wrong, which makes me believe that maybe there is an issue with unbound. Even though I couldn't find any related issue.

Please tell me if I need to provide additional information.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Unbound fails to resolve certain domains when going from 1.11 to 1.12 #360

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Uh oh!

Unbound fails to resolve certain domains when going from 1.11 to 1.12 #360

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions