# Is dnssec working?

**URL:** <https://discourse.pi-hole.net/t/is-dnssec-working/24235>\
**Category:** General\
**Created:** [October 2, 2019, 6:15pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235 "2019-10-02T18:15:56Z")\
**Posts on this page:** 20\
**Page:** 2

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [October 4, 2019, 1:12pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/23 "2019-10-04T13:12:24Z")

</div>

```auto
pi@pi-hole:~ $ sudo unbound -d -vvvvv
[1570194362] unbound[28022:0] notice: Start of unbound 1.6.0.
[1570194362] unbound[28022:0] debug: increased limit(open files) from 1024 to 4140
[1570194362] unbound[28022:0] debug: creating udp4 socket 127.0.0.1 5353
[1570194362] unbound[28022:0] debug: creating tcp4 socket 127.0.0.1 5353
[1570194362] unbound[28022:0] debug: creating tcp4 socket 127.0.0.1 8953
[1570194362] unbound[28022:0] debug: setup SSL certificates
[1570194362] unbound[28022:0] debug: chdir to /etc/unbound
[1570194362] unbound[28022:0] debug: drop user privileges, run as unbound
[1570194362] unbound[28022:0] debug: switching log to /var/log/unbound.log

```

I think this may be linked with qname minimisation.  
I noted I had a file `qname-minimisation.conf` in `/etc/unbound/unbound.conf.d`  
This file contains:

```auto
qname-minimisation: yes

```

If I remove this file and add the qname option to the main `/unbound.conf.d/pihole.conf` file I see similar behaviour.  
If I change the option to ` qname-minimisation: no` I see similar behaviour.  
If I remove `qname-minimisation` completely from the config, I dont appear to have any problems

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [October 4, 2019, 1:25pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/25 "2019-10-04T13:25:18Z")

</div>

im running stretch lite.  
`apt-cache policy` tells me 1.6.0 is the latest available version for this distro  
Im not sure i know how to compile etc to bump up the unbound version?

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [October 4, 2019, 1:28pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/26 "2019-10-04T13:28:54Z")

</div>

> [@anon55913113](#):
>
> You are using a outdated version of Unbound that is still current on Jessie and Stretch with Debian.

This should have no bearing on the problem. The older version of unbound still works properly.

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [October 4, 2019, 1:31pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/27 "2019-10-04T13:31:30Z")

</div>

> [@jfb](#):
>
> This should have no bearing on the problem. The older version of unbound still works properly.

This would be my understanding also, but at this point ill try anything to have it working as i want.  
Ive added `deb http://ftp.uk.debian.org/debian sid main` to my `/etc/apt/sources.list`  
guess i cross my fingers now? 🤷‍♂️  
edit: no key for [http://ftp.uk.debian.org/debian](http://ftp.uk.debian.org/debian)  
Is there any know issues with qname minimisation? Ive not found anything via Google?

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [October 4, 2019, 1:40pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/29 "2019-10-04T13:40:54Z")

</div>

> [@anon55913113](#):
>
> If you can life without the qname minimization and all works now then stay on it and when 1.94 is current you can always try that.

I can live without it, but the point is i shouldnt _have_ to. As others have the same version of unbound running, and working, there must be something up on my install? And im a tinkerer, and would like to know what and how to fix!

> [@anon55913113](#):
>
> If you have you RaspberryPI only for Pihole and Unbound then also consider to move to Buster which is the current version for the RaspberryPI.

Currently I have pi-hole, unbound and OpenVPN running on this particular rasperry pi.  
Ive looked at doing an in place upgrade to Buster, just nervous about losing data and current setup etc. and not had time to make a backup of the sd card

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [October 9, 2019, 5:21pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/30 "2019-10-09T17:21:22Z")

</div>

I'm still seeing `SERVFAIL` error in my logs, for every query now.  
Any tips on where to start?

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [October 9, 2019, 5:36pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/31 "2019-10-09T17:36:22Z")

</div>

SERVFAIL typically indicates that the DNSSEC process could not be completed. If the time/date on the Pi are correct, that may indicate a problem with your certificate.

If it were me, I would do a complete unbound removal, then reinstall.

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [October 9, 2019, 5:38pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/32 "2019-10-09T17:38:02Z")

</div>

I've checked the time and it's correct.  
How would you best advise to completely remove unbound from the system?

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [October 9, 2019, 5:39pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/33 "2019-10-09T17:39:06Z")

</div>

I would do the opposite of how you installed it. Stop the program, uninstall it, then eliminate all the configuration files.

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [October 9, 2019, 5:39pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/34 "2019-10-09T17:39:44Z")

</div>

Ok, so `apt purge`? Then manually check for config files etc?

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [October 9, 2019, 5:42pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/35 "2019-10-09T17:42:03Z")

</div>

Yes, that would be the process I would follow.

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [October 9, 2019, 5:42pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/36 "2019-10-09T17:42:56Z")

</div>

Thanks, appreciate your help.  
I'll try that now, brace yourself for more questions to follow 🤷‍♂️

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [October 9, 2019, 6:26pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/37 "2019-10-09T18:26:16Z")

</div>

Quick question....  
When I create the pi-hole unbound conf file in `/etc/unbound/unbound.conf.d` what user should the file be created as?  
`sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf`  
Or  
`nano /etc/unbound/unbound.conf.d/pi-hole.conf`

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [October 9, 2019, 6:40pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/38 "2019-10-09T18:40:03Z")

</div>

You will need to use sudo nano, since the permission on that folder are root.

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [October 9, 2019, 6:43pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/39 "2019-10-09T18:43:05Z")

</div>

Of course 🤦‍♂️

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [October 9, 2019, 6:54pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/40 "2019-10-09T18:54:08Z")

</div>

So, I've fully uninstalled unbound.  
Manually deleted any remaining config files  
Reinstalled unbound following the guide to the letter.

And yeah, you guessed...still have `SERVFAIL` errors.  
[https://dnssec.vs.uni-due.de/](https://dnssec.vs.uni-due.de/) reports that dnssec is not working  
(This is the case on multiple browsers)  
Yet if I use the `dig` commands noted in the guide the results are as expected.  
Head and brick wall

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [October 11, 2019, 4:59pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/41 "2019-10-11T16:59:21Z")

</div>

Still Looking for help on this, I've had to revert to using 'normal' upstream servers.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [October 11, 2019, 5:33pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/42 "2019-10-11T17:33:29Z")

</div>

I think you will have to find the solution on the unbound forums.

---

<div class="post-metadata">

**Author:** ![Valiceemo](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/valiceemo/32/2825_2.png) [@Valiceemo](https://discourse.pi-hole.net/u/Valiceemo)\
**Post date:** [October 11, 2019, 5:39pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/43 "2019-10-11T17:39:23Z")

</div>

Could you point me in the right direction? I can't seem to find any forums for unbound at all

---

<div class="post-metadata">

**Author:** ![drewski](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/drewski/32/7476_2.png) [@drewski](https://discourse.pi-hole.net/u/drewski)\
**Post date:** [October 11, 2019, 5:57pm UTC](https://discourse.pi-hole.net/t/is-dnssec-working/24235/45 "2019-10-11T17:57:06Z")

</div>

I would ask here.

> **[NLnetLabs/unbound](https://github.com/NLnetLabs/unbound/issues)**
>
> Unbound is a validating, recursive, and caching DNS resolver. - NLnetLabs/unbound

[Previous page](https://discourse.pi-hole.net/t/is-dnssec-working/24235.md?page=1)

[Next page](https://discourse.pi-hole.net/t/is-dnssec-working/24235.md?page=3)