Negative Domains on Adlists / Gravity DNS Resolution

[Bucking_Horn]

That output suggests that DNS traffic from your network to your Docker host on the defaut port (53) and on port 5053 is correctly routed by Docker to the respective Pi-hole and unbound containers, and that both Pi-hole and unbound are responding as expected.

I am curious about your unbound configuration, though:

@broomwalker

  unbound:
    container_name: unbound
   (...)
    ports:
    - "5053:5053/tcp"
    - "5053:5053/udp"

Those lines map your host's port 5053 to port 5053 of your unbound container.
But how did you actually configure unbound to bind to port 5053 instead of its port 53 default?

Also, when I asked to verify Pi-hole's required ports, did you change anything on your host OS?

[broomwalker]

@Bucking_Horn

Those lines map your host's port 5053 to port 5053 of your unbound container.
But how did you actually configure unbound to bind to port 5053 instead of its port 53 default?

Hmm, I’m not sure how to answer that. As above I’ve followed that guide - maybe the docker-compose is incorrect?

Should it be something like the following?

ports:
    - "5053:53/tcp"
    - "5053:53/udp"

@Bucking_Horn

Also, when I asked to verify Pi-hole's required ports, did you change anything on your host OS?

I didn’t change anything on the Raspberry Pi. I’m not sure what you mean by “verify required ports” / did you want me to do something?

This might help to understand the other ports used:

[Bucking_Horn]

@broomwalker

I didn’t change anything on the Raspberry Pi. I’m not sure what you mean by “verify required ports” / did you want me to do something?

I was referring to my earlier:

@Bucking_Horn

Please make sure that your Docker host OS is allowing required ports , specifically DNS/port 53 traffic.

It's ok if you didn't change anything - the dig results show that your machine is responding.

@broomwalker

Should it be something like the following?

ports:
    - "5053:53/tcp"
    - "5053:53/udp"

I cannot answer that.
Nevertheless, it's what I would expect if you did nothing to configure unbound within its container.
As a DNS resolver, unbound would bind port 53 by default.
But the maintainer of that image may have preconfigured it for a different port within that image.
I'd expect that to be a documented feature if it is - you should probably check that image's documentation.

In the meantime, it wouldn't hurt to give that setting a try to see if it fixes your issue.
It's easy enough to apply and revert those changes.

EDIT:
You may also have to change the port for Pi-hole's upstream to 53 (or to remove #5053):

@broomwalker

services:
  pihole:
    container_name: pihole
(...)
    environment:
(...)
    - 'DNS1=172.22.0.7#5053'

[broomwalker]

Well thanks for the help (truly)! But this has become all too difficult… would be fantastic if there was an official pihole/unbound docker image.

I’m thinking I’ll try Pihole as a docker and Unbound normally like I did previously.

Any land mines to look out for if I try this approach following the Unbound instructions here:

unbound - Pi-hole documentation

I assume there’s no issue with the 127.0.0.1 interface being used for Unbound, and Pihole being 172.22.0.7?

[Bucking_Horn]

@broomwalker

But this has become all too difficult…

I agree that analysing your issue may seem difficult, but I don't think you should retreat without trying my recent suggestion (apologies if you've already done so).

It would just require to change a port 5053 to 53 in three locations, restart your containers, and see if a gravity update would finally populate your gravity database.