# Hyperlocal: Is it meaningful to hold a local copy of the root zone?

**URL:** <https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462>\
**Category:** General\
**Created:** [November 15, 2018, 8:03am UTC](https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462 "2018-11-15T08:03:42Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![Troy\_McClure](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/troy_mcclure/32/3837_2.png) [@Troy\_McClure](https://discourse.pi-hole.net/u/Troy_McClure)\
**Post date:** [November 15, 2018, 8:03am UTC](https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462/1 "2018-11-15T08:03:42Z")

</div>

Hallo,

hab gerade bei Heise folgendes gesehen:

[https://www.heise.de/newsticker/meldung/Hyperlocal-Wenn-die-DNS-Root-Zone-zu-Hause-steht-4215364.html](https://www.heise.de/newsticker/meldung/Hyperlocal-Wenn-die-DNS-Root-Zone-zu-Hause-steht-4215364.html)

wäre es möglich und überhaupt sinnvoll das auf dem Pi einzurichten?

* * *

**English translation by @DL6ER** : This article describes downloading and maintaining a local copy of the DNS root zone. Te question is whether it is possible and/or useful to do this on a Raspberry Pi.

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [November 15, 2018, 8:42am UTC](https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462/2 "2018-11-15T08:42:29Z")

</div>

Sorry, I don't speak german…

In order to do this you need to implement the [unbound solution](https://docs.pi-hole.net/guides/unbound/), proposed by the pihole developers.

Duplicating the root zone (zone transfert) has been partially discussed [here](https://discourse.pi-hole.net/t/dns-security-anonymity-and-pi-hole-what-are-the-options/13984)

I'm running the latest version of Raspbian (oktober 2018). It isn't possible with the unbound version, included in this distro, you need at least unbound version 1.7 (mentioned in the article (on discourse)).  
It is however possible to compile and use the latest version of unbound (1.8.1) and use the feature. This requires a lot of work, since the original Raspbian package (version 1.6.x) doesn't appear to use chroot, and some additional software (not included in the unbound package)

The unbound config I'm using looks like this (everything ends up in `/etc/unbound`):

```auto
server:
    logfile: /unbound.log
    verbosity: 1
   interface: 127.x.x.x@55xx
   interface: xxxx:xxxx:xxxx:xxxx::xxxx@55xx
   do-ip4: yes
   do-udp: yes
   do-tcp: yes
   do-ip6: yes
   root-hints: "/root.hints"
   harden-glue: yes
   harden-dnssec-stripped: yes
   use-caps-for-id: no
   cache-min-ttl: 3600
   cache-max-ttl: 86400
   prefetch: yes
   num-threads: 1
   so-rcvbuf: 1m
   edns-buffer-size: 1472
   private-address: 192.168.0.0/16
   private-address: 169.254.0.0/16
   private-address: 172.16.0.0/12
   private-address: 10.0.0.0/8
   private-address: fd00::/8
   private-address: fe80::/10

```

for some reason, discourse doesn't show the entire config file, so the config continues here (It is a single config file)...

```auto
remote-control:
   control-enable: yes

auth-zone:
   name: "."
   master: i.root-servers.net
   master: f.root-servers.net
   master: j.root-servers.net
   master: k.root-servers.net
   fallback-enabled: yes
   for-downstream: no
   for-upstream: yes
   zonefile: "/root.zone"

```

I've copied the original unbound.conf from the raspian distribution, witch simply includes everything in `/etc/unbound/unbound.conf.d`. I've also copied `/etc/unbound/unbound.conf.d/qname-minimisation.conf` and `/etc/unbound/unbound.conf.d/root-auto-trust-anchor-file.conf` from the Raspbian distribution into that directory, and placed my `unbound.conf ` (see above) in this directory

To compile unbound 1.8.1 (on Raspbian), I'm using the following script:

```auto
#!/bin/bash

# Make sure only root can run our script
if ["$(id -u)" != "0"]; then
  echo "This script must be run as root" 1>&2
  exit 1
fi

# install dnsutils
sudo apt-get -y install dnsutils
# install drill
# usage drill txt qnamemintest.internet.nl
# result HOORAY - QNAME minimisation is enabled on your resolver
sudo apt-get -y install ldnsutils

sudo apt-get -y install libssl-dev
sudo apt-get -y install libexpat1-dev

sudo groupadd -g 991 unbound
sudo useradd -c "unbound-1.8.1" -d /var/lib/unbound -u 991 -g unbound -s /bin/false unbound

file=unbound-1.8.1
mkdir -p unbound
cd unbound
wget https://nlnetlabs.nl/downloads/unbound/$file.tar.gz

```

for some reason, discourse doesn' show the entire script, so script continues here (It is a single script)...

```auto
tar xzf $file.tar.gz 
cd $file

sudo ./configure --prefix=/usr --sysconfdir=/etc --disable-static --with-pidfile=/run/unbound.pid
sudo make
sudo make install

```

I haven't figured out how to compile unbound with system, so I created my own `/lib/systemd/system/unbound.service`, content:

```auto
[Unit]
Description=Unbound DNS server
Documentation=man:unbound(8)
Requires=network.target
Wants=nss-lookup.target
Before=nss-lookup.target
After=network.target

[Service]
ExecStartPre=/usr/sbin/unbound-anchor -a /etc/unbound/root.key -v
ExecStart=/usr/sbin/unbound -d -v
ExecReload=/bin/kill -HUP $MAINPID
Restart=always
RestartSec=360

[Install]
WantedBy=multi-user.target

```

enable the unbound system configuration, using this:

```auto
sudo systemctl daemon-reload
sudo systemctl enable unbound.service

```

Hope this helps, I also wonder if this is beneficiary for privacy...

---

<div class="post-metadata">

**Author:** ![Troy\_McClure](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/troy_mcclure/32/3837_2.png) [@Troy\_McClure](https://discourse.pi-hole.net/u/Troy_McClure)\
**Post date:** [November 15, 2018, 8:54am UTC](https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462/3 "2018-11-15T08:54:40Z")

</div>

thanks for the extensive reply!  
you think its not really worth the effort to do this? my first thought was something like that, too. perhaps i will try it anyway when im really extremely bored 🙂

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [November 15, 2018, 8:59am UTC](https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462/4 "2018-11-15T08:59:17Z")

</div>

NOT entirely sure it is worth the effort, I did it anyway...

@DL6ER  
Is this beneficiary for privacy?  
How to verify the unbound DNS request to the root entries are using the local copy?  
How often do you need to update the copy? It currently does this only when unbound starts, unless forced by `sudo /usr/sbin/unbound-control auth_zone_transfer "."`

---

<div class="post-metadata">

**Author:** ![Troy\_McClure](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/troy_mcclure/32/3837_2.png) [@Troy\_McClure](https://discourse.pi-hole.net/u/Troy_McClure)\
**Post date:** [November 15, 2018, 5:20pm UTC](https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462/6 "2018-11-15T17:20:17Z")

</div>

have it up and running now, seems to be quite quick an can give a little bit of privacy perhaps...

edit: only seemed to be any effort btw, followed these:

> **[Redirecting...](https://docs.pi-hole.net/guides/unbound/)**

and it took something about 5 minutes...

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [November 15, 2018, 5:28pm UTC](https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462/7 "2018-11-15T17:28:22Z")

</div>

> [@jpgpi250](#):
>
> Is this beneficiary for privacy?

No. Full-stop.  
With qname minimization (enabled by default), the root servers will only be queried for the TLD, i.e., the request will only be for `.de` or `.com`. There is no way this would leak anything really. In addition, you'll still have to contact the name servers one level further down, so anyone "watching" you will still know if you visit a suspicious, e.g., Russian webpage.  
TL;DR: No privacy is gained by having a local copy.

What it will be beneficial for is that it will provide a local copy for the top level. This will speed up _the first_ query for an individual TLD after `unbound` has been restarted. After the first query, e.g., to `something.de`, your local `unbound` will hold the corresponding reply in it's cache and will also take care of always refreshing the information before it expires so there should be no benefit at all once you queried domains under all relevant TLDs at least once.

I looked at the article @Troy_McClure posted above and they mix up a few things.  
To summarize things: As `unbound` used an internal cache, qname minimization and does DNSSEC validation by default, the vast majority of the benefits mentioned in the article are void.  
Furthermore, as Pi-hole is cascaded in front, requests for your local domain should not even be forwarded to `unbound` and can also never propagate through to the root servers (this is once thing they mention concerning privacy).

> [@jpgpi250](#):
>
> How often do you need to update the copy?

I cannot give any reliable figures, but I doubt that they'd need to be updated more often than maybe once a month. Maybe once every three months or even once a year is sufficient. The DNS servers referenced in this data are all global players, being relevant/responsible for an entire TLD such as `.com`, I don't think that the IP addresses of these servers change very often.

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [November 15, 2018, 5:34pm UTC](https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462/8 "2018-11-15T17:34:13Z")

</div>

I will rename the header and move this into General so everyone can have a look at this discussion.

---

<div class="post-metadata">

**Author:** ![Troy\_McClure](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/troy_mcclure/32/3837_2.png) [@Troy\_McClure](https://discourse.pi-hole.net/u/Troy_McClure)\
**Post date:** [November 15, 2018, 6:48pm UTC](https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462/9 "2018-11-15T18:48:25Z")

</div>

> [@DL6ER](#):
>
> With qname minimization (enabled by default), the root servers will only be queried for the TLD, i.e., the request will only be for `.de` or `.com` .

will it be more beneficiary for privacy with this Option disabled and will that give a big/any performance impact?  
not the pentagon at here but why not use such a solution...

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [November 15, 2018, 6:50pm UTC](https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462/10 "2018-11-15T18:50:38Z")

</div>

> [@Troy\_McClure](#):
>
> will it be more beneficiary for privacy with this Option disabled and will that give a big/any performance impact?

This is actually rather difficult to answer. From my experience, I'd say that all issues with qname minimization have been fixed and that there is no obvious benefit in disabling it. Disabling it would clearly not increase privacy (rather decrease it!).

---

<div class="post-metadata">

**Author:** ![Troy\_McClure](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/troy_mcclure/32/3837_2.png) [@Troy\_McClure](https://discourse.pi-hole.net/u/Troy_McClure)\
**Post date:** [November 15, 2018, 7:12pm UTC](https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462/11 "2018-11-15T19:12:17Z")

</div>

> [@DL6ER](#):
>
> To summarize things: As `unbound` used an internal cache, qname minimization and does DNSSEC validation by default, the vast majority of the benefits mentioned in the article are void.

ok, when qname minimization is ok, what else voids the benefits mentioned ?

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [November 15, 2018, 7:30pm UTC](https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462/12 "2018-11-15T19:30:34Z")

</div>

> [@Troy\_McClure](#):
>
> ok, when qname minimization is ok, what else voids the benefits mentioned ?

One of the points / or maybe their major point is that a local copy would eliminate the first query to the root servers. This argument is nullified by `unbound`'s cache as it would never query the root zone again for a TLD as it already stores a local copy once the first query was made.

Don't misunderstand me - I'm mainly arguing that `unbound` is already so efficient and well implemented that most of the problems they address and that could be solved by a local copy don't even exist in the first place - there is no room for improvement if your existing server already does most of it.

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [November 18, 2018, 8:29pm UTC](https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462/18 "2018-11-18T20:29:53Z")

</div>

> [@anon55913113](#):
>
> The line with **tcp-upstream: yes** is telling Unbound to only use TCP to send and receive DNS information.

Just a small hint: This will cause a notable increase in the amount of that that is sent around and will likely increase delays in transit. Well, it will probably to too bad in the end when your Pi-hole can utilize the cache to a sufficient amount.

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [November 18, 2018, 9:02pm UTC](https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462/20 "2018-11-18T21:02:11Z")

</div>

> [@anon55913113](#):
>
> I thought that DNS was easy but there are still a lot of pitfalls.

Well, it very much depends on your particular setup. Anyways I just wanted to point this out in case others users will find this at some point in the future and would blindly follow any configs they find online.

> [@anon55913113](#):
>
> Otherwise there would be a double caching hapening.

There is no harm in double caching things. The TTL should ensure that the data is kept only as long as it is meaningful.

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [November 20, 2018, 5:51am UTC](https://discourse.pi-hole.net/t/hyperlocal-is-it-meaningful-to-hold-a-local-copy-of-the-root-zone/14462/23 "2018-11-20T05:51:57Z")

</div>

> [@anon55913113](#):
>
> if you are the only user of a DNS then upstream cache is obsolete due to this.

Not if you are visiting the same page multiple times - often enough browsers like Firefox send dozens of queries even when visitng a page only _once_ while it is loading the multiple contents that are there on modern webpages.

Furthermore, Pi-hole (as a DNS frontend) caches only exact hits (like `whatever.domain.com`). Unbound (as DNS backend / recursive resolver) will also cache the answers for `domain.com` and (quite importantly) `com`.

You mentioned pre-fetching. This is also very useful and will help with the overall latency of your system.

Conclusion: Both caches have their place: Exact matches are quickly answered by Pi-hole itself. Partial matches shorten the DNS path, `unbound` has to traverse if it holds parts of this path (e.g. `domain.com`) already in its cache. If Pi-hole's cache wouldn't be there, everything would always have to be passed to `unbound` (just another step in the chain causing some unnecessary delay). If `unbounds` cache wouldn't be there, unknown domains would have to be walked every time starting from the root zone down to the node you requested.