{{tag>Brouillon DNS Resolveur CA}}

= Notes serveur DNS Unbound

Voir : 
 * https://nlnetlabs.nl/documentation/unbound/unbound.conf/
 * https://github.com/iusrepo/unbound1/blob/main/unbound.conf

Voir aussi :
* * [[https://coredns.io/|CoreDNS]] (cncf.io)


Exemple sur RedHat

Fix Unbound is very slow to start

''/etc/sysconfig/unbound''
<code bash>
DISABLE_UNBOUND_ANCHOR=yes
</code>


== Conf Unbound en resolveur avec Cache DNS

''/etc/unbound/unbound.conf''
<code yaml>
server:
        #verbosity: 1
        #use-syslog: no
        #module-config: "subnetcache validator iterator"

        interface: 127.0.0.53
        #interface: ::0

        #prefer-ip4: yes
        #prefer-ip6: no
        do-ip4: yes
        do-ip6: no
        #do-tcp: yes

        access-control: 127.0.0.0/8 allow
        #cache-min-ttl: 3600
        #cache-max-ttl: 86400
        cache-max-negative-ttl: 1
        #prefetch: yes
        #serve-expired: yes
        #serve-expired-ttl: 14400
        #qname-minimisation: yes # Default yes
        #minimal-responses: yes  # Default yes
        #rrset-roundrobin: yes   # Default yes

forward-zone:
        name: "."
        forward-addr: 8.8.8.8
        forward-addr: 8.8.4.4
</code>

<code bash>
unbound-checkconf
systemctl enable --now unbound.service
</code>


== Conf autres

no-aaaa

Voir : https://github.com/berstend/unbound-no-aaaa/tree/master/etc/unbound


== Administration

Source : https://gist.github.com/f9n/3c4453489820f150c81bdf2f1ccd9516

Verify configuration
<code bash>
unbound-checkconf
</code>

Unbound Status
<code bash>
unbound-control status
</code>

List Forwards
<code bash>
unbound-control list_forwards
</code>

Lookup on Cache
<code bash>
unbound-control lookup youtube.com
</code>

Dump Cache
<code bash>
unbound-control dump_cache > dns-cache.txt
</code>

Restore Cache
<code bash>
unbound-control load_cache < dns-cache.txt
</code>

Flush Cache
<code bash>
# Flush Specific Host
unbound-control flush www.youtube.com

# Flush everything
unbound-control flush_zone .
</code>


=== Diag




Increase logged verbosity only runtime
<code bash>
unbound-control verbosity 3
</code>

Print operational statistics numbers.
<code bash>
unbound-control stats
</code>


Print used root server hints
<code bash>
unbound-control list_stubs
</code>

Print contacted servers details. Useful to read how fast they respond and what features they support.
<code bash>
unbound-control dump_infra
</code>

Test DNSSEC status of host
<code bash>
unbound-host -rv example.net -D
</code>


== Autres


Essaie de surcharger la conf /etc/unbound/unbound.conf (RedHat)

''/etc/unbound/cond.d/common.conf''
<code yaml>
server:
        #trust-anchor-file: ""
        #auto-trust-anchor-file: ""
        #trust-anchor: ""
        #trusted-keys-file: ""
        #val-permissive-mode: yes
        #prefetch: no
        #disable-dnssec-lame-check: no
        #harden-dnssec-stripped: no
        #harden-glue: no
        #harden-below-nxdomain: no
        #harden-referral-path: no
</code>