Sorry, I don't speak german…
In order to do this you need to implement the unbound solution, proposed by the pihole developers.
Duplicating the root zone (zone transfert) has been partially discussed here
I'm running the latest version of Raspbian (oktober 2018). It isn't possible with the unbound version, included in this distro, you need at least unbound version 1.7 (mentioned in the article (on discourse)).
It is however possible to compile and use the latest version of unbound (1.8.1) and use the feature. This requires a lot of work, since the original Raspbian package (version 1.6.x) doesn't appear to use chroot, and some additional software (not included in the unbound package)
The unbound config I'm using looks like this (everything ends up in /etc/unbound):
server:
logfile: /unbound.log
verbosity: 1
interface: 127.x.x.x@55xx
interface: xxxx:xxxx:xxxx:xxxx::xxxx@55xx
do-ip4: yes
do-udp: yes
do-tcp: yes
do-ip6: yes
root-hints: "/root.hints"
harden-glue: yes
harden-dnssec-stripped: yes
use-caps-for-id: no
cache-min-ttl: 3600
cache-max-ttl: 86400
prefetch: yes
num-threads: 1
so-rcvbuf: 1m
edns-buffer-size: 1472
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: 172.16.0.0/12
private-address: 10.0.0.0/8
private-address: fd00::/8
private-address: fe80::/10
for some reason, discourse doesn't show the entire config file, so the config continues here (It is a single config file)...
remote-control:
control-enable: yes
auth-zone:
name: "."
master: i.root-servers.net
master: f.root-servers.net
master: j.root-servers.net
master: k.root-servers.net
fallback-enabled: yes
for-downstream: no
for-upstream: yes
zonefile: "/root.zone"
I've copied the original unbound.conf from the raspian distribution, witch simply includes everything in /etc/unbound/unbound.conf.d. I've also copied /etc/unbound/unbound.conf.d/qname-minimisation.conf and /etc/unbound/unbound.conf.d/root-auto-trust-anchor-file.conf from the Raspbian distribution into that directory, and placed my unbound.conf (see above) in this directory
To compile unbound 1.8.1 (on Raspbian), I'm using the following script:
#!/bin/bash
# Make sure only root can run our script
if [ "$(id -u)" != "0" ]; then
echo "This script must be run as root" 1>&2
exit 1
fi
# install dnsutils
sudo apt-get -y install dnsutils
# install drill
# usage drill txt qnamemintest.internet.nl
# result HOORAY - QNAME minimisation is enabled on your resolver
sudo apt-get -y install ldnsutils
sudo apt-get -y install libssl-dev
sudo apt-get -y install libexpat1-dev
sudo groupadd -g 991 unbound
sudo useradd -c "unbound-1.8.1" -d /var/lib/unbound -u 991 -g unbound -s /bin/false unbound
file=unbound-1.8.1
mkdir -p unbound
cd unbound
wget https://nlnetlabs.nl/downloads/unbound/$file.tar.gz
for some reason, discourse doesn' show the entire script, so script continues here (It is a single script)...
tar xzf $file.tar.gz
cd $file
sudo ./configure --prefix=/usr --sysconfdir=/etc --disable-static --with-pidfile=/run/unbound.pid
sudo make
sudo make install
I haven't figured out how to compile unbound with system, so I created my own /lib/systemd/system/unbound.service, content:
[Unit]
Description=Unbound DNS server
Documentation=man:unbound(8)
Requires=network.target
Wants=nss-lookup.target
Before=nss-lookup.target
After=network.target
[Service]
ExecStartPre=/usr/sbin/unbound-anchor -a /etc/unbound/root.key -v
ExecStart=/usr/sbin/unbound -d -v
ExecReload=/bin/kill -HUP $MAINPID
Restart=always
RestartSec=360
[Install]
WantedBy=multi-user.target
enable the unbound system configuration, using this:
sudo systemctl daemon-reload
sudo systemctl enable unbound.service
Hope this helps, I also wonder if this is beneficiary for privacy...