# Unbound DNS keeps on returning SERVFAIL status

**URL:** <https://discourse.pi-hole.net/t/unbound-dns-keeps-on-returning-servfail-status/54093>\
**Category:** Help\
**Created:** [March 6, 2022, 10:39am UTC](https://discourse.pi-hole.net/t/unbound-dns-keeps-on-returning-servfail-status/54093 "2022-03-06T10:39:14Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![anon74845050](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/d78d45/32.png) [@anon74845050](https://discourse.pi-hole.net/u/anon74845050)\
**Post date:** [March 6, 2022, 10:39am UTC](https://discourse.pi-hole.net/t/unbound-dns-keeps-on-returning-servfail-status/54093/1 "2022-03-06T10:39:14Z")

</div>

## Expected Behaviour:

Hi, I'm a newbie to pi-hole, and I'm trying to make my local recursive DNS server via Unbound. I follow the official documentation on this ([unbound - Pi-hole documentation](https://docs.pi-hole.net/guides/dns/unbound/)). Supposedly, at the step where I test if the server is operational (command: dig pi-hole.net @ 127.0.0.1 -p 5335), it should return a status report of "NOERROR" with an IP address, right?

Also, in testing the DNSSEC validation (the two commands at the official documentation), the first command should give the status report of "SERVFAIL" and no IP address, and the second should give "NOERROR" with an IP address.

## Actual Behaviour:

However, these are the results that I get:

 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/6/9/691a7f87377b1f76e6e8401007aca5b6c5f4c8f0.png)

At testing the DNSSEC validation, I get:

 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/8/2/82c55681b1493c5943635f0cd448f38ba2b47617.png)

 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/2/7/27c1b043ac6e2685086fb5a8d52deb18fd6f7a77.png)

I am now stuck at this part. I don't know why it keeps returning the "SERVFAIL" report. I appreciate your help on this one. Thank you very much for your time.

## Debug Token:

[https://tricorder.pi-hole.net/OSuIBRCc/](https://tricorder.pi-hole.net/OSuIBRCc/)

---

<div class="post-metadata">

**Author:** ![anon74845050](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/d78d45/32.png) [@anon74845050](https://discourse.pi-hole.net/u/anon74845050)\
**Post date:** [March 6, 2022, 10:42am UTC](https://discourse.pi-hole.net/t/unbound-dns-keeps-on-returning-servfail-status/54093/2 "2022-03-06T10:42:38Z")

</div>

My debug token is OSuIBRCc for any helpers who can't access the link. Thank you.

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [March 6, 2022, 4:28pm UTC](https://discourse.pi-hole.net/t/unbound-dns-keeps-on-returning-servfail-status/54093/3 "2022-03-06T16:28:31Z")

</div>

As you are running Bullseye, you may be affected by [WARNING: Raspbian October 2021 release bullseye + unbound](https://discourse.pi-hole.net/t/warning-raspbian-october-2021-release-bullseye-unbound/51027).

Run from your Pi-hole host machine, what's the output of:

```auto
sudo grep -v '#\|^$' -R /etc/unbound/unbound.conf*

```

---

<div class="post-metadata">

**Author:** ![anon74845050](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/d78d45/32.png) [@anon74845050](https://discourse.pi-hole.net/u/anon74845050)\
**Post date:** [March 7, 2022, 12:05pm UTC](https://discourse.pi-hole.net/t/unbound-dns-keeps-on-returning-servfail-status/54093/4 "2022-03-07T12:05:40Z")

</div>

```auto
pi@raspberrypi:~ $ sudo grep -v '#\|^$' -R /etc/unbound/unbound.conf*

/etc/unbound/unbound.conf:include-toplevel: "/etc/unbound/unbound.conf.d/*.conf"
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf:forward-zone:
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf:	name: "."
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf:	forward-addr: 2001:4450:f0:2::c53
/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf:	forward-addr: 2001:4450:f0:e::c53
/etc/unbound/unbound.conf.d/root-auto-trust-anchor-file.conf:server:
/etc/unbound/unbound.conf.d/root-auto-trust-anchor-file.conf: auto-trust-anchor-file: "/var/lib/unbound/root.key"
/etc/unbound/unbound.conf.d/pi-hole.conf:server:
/etc/unbound/unbound.conf.d/pi-hole.conf: verbosity: 0
/etc/unbound/unbound.conf.d/pi-hole.conf: interface: 127.0.0.1
/etc/unbound/unbound.conf.d/pi-hole.conf: port: 5335
/etc/unbound/unbound.conf.d/pi-hole.conf: do-ip4: yes
/etc/unbound/unbound.conf.d/pi-hole.conf: do-udp: yes
/etc/unbound/unbound.conf.d/pi-hole.conf: do-tcp: yes
/etc/unbound/unbound.conf.d/pi-hole.conf: do-ip6: no
/etc/unbound/unbound.conf.d/pi-hole.conf: prefer-ip6: no
/etc/unbound/unbound.conf.d/pi-hole.conf: harden-glue: yes
/etc/unbound/unbound.conf.d/pi-hole.conf: harden-dnssec-stripped: yes
/etc/unbound/unbound.conf.d/pi-hole.conf: use-caps-for-id: no
/etc/unbound/unbound.conf.d/pi-hole.conf: edns-buffer-size: 1232
/etc/unbound/unbound.conf.d/pi-hole.conf: prefetch: yes
/etc/unbound/unbound.conf.d/pi-hole.conf: num-threads: 1
/etc/unbound/unbound.conf.d/pi-hole.conf: so-rcvbuf: 1m
/etc/unbound/unbound.conf.d/pi-hole.conf: private-address: 192.168.0.0/16
/etc/unbound/unbound.conf.d/pi-hole.conf: private-address: 169.254.0.0/16
/etc/unbound/unbound.conf.d/pi-hole.conf: private-address: 172.16.0.0/12
/etc/unbound/unbound.conf.d/pi-hole.conf: private-address: 10.0.0.0/8
/etc/unbound/unbound.conf.d/pi-hole.conf: private-address: fd00::/8
/etc/unbound/unbound.conf.d/pi-hole.conf: private-address: fe80::/10

```

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [March 7, 2022, 12:13pm UTC](https://discourse.pi-hole.net/t/unbound-dns-keeps-on-returning-servfail-status/54093/5 "2022-03-07T12:13:10Z")

</div>

Seems like you are indeed affected by [WARNING: Raspbian October 2021 release bullseye + unbound](https://discourse.pi-hole.net/t/warning-raspbian-october-2021-release-bullseye-unbound/51027).

To fix this, try

1. Edit file `/etc/resolvconf.conf` and comment out the last line which should read:

`unbound_conf=/etc/unbound/unbound.conf.d/resolvconf_resolvers.conf`

1. Delete the unwanted unbound configuration file:

`sudo rm /etc/unbound/unbound.conf.d/resolvconf_resolvers.conf`

1. Restart unbound:

`sudo service unbound restart`

---

<div class="post-metadata">

**Author:** ![anon74845050](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/d78d45/32.png) [@anon74845050](https://discourse.pi-hole.net/u/anon74845050)\
**Post date:** [March 7, 2022, 12:29pm UTC](https://discourse.pi-hole.net/t/unbound-dns-keeps-on-returning-servfail-status/54093/6 "2022-03-07T12:29:16Z")

</div>

It worked. Thank you so much. Will study the link you have provided. Have a nice day.

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [March 7, 2022, 12:32pm UTC](https://discourse.pi-hole.net/t/unbound-dns-keeps-on-returning-servfail-status/54093/7 "2022-03-07T12:32:33Z")

</div>

That's a very extensive discussion on analysing the issue and developing several solution approaches. You can skip reading all that if you wouldn't be too interested in all that background and if above steps have worked for you. 😉

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [March 28, 2022, 12:33pm UTC](https://discourse.pi-hole.net/t/unbound-dns-keeps-on-returning-servfail-status/54093/8 "2022-03-28T12:33:25Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.