# Unbound DNSSEC validation not working

**URL:** <https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562>\
**Category:** Help\
**Created:** [October 23, 2021, 4:50pm UTC](https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562 "2021-10-23T16:50:02Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chris\_Anthony](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/chris_anthony/32/15001_2.png) [@Chris\_Anthony](https://discourse.pi-hole.net/u/Chris_Anthony)\
**Post date:** [October 23, 2021, 4:50pm UTC](https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562/1 "2021-10-23T16:50:02Z")

</div>

#### Please follow the below template, it will help us to help you!

### _If you are Experiencing issues with a Pi-hole install that has non-standard elements (e.g you are using `nginx` instead of `lighttpd`, or there is some other aspect of your install that is customised) - please use the [Community Help](https://discourse.pi-hole.net/c/bugs-problems-issues/community-help/36) category._

## Expected Behaviour:

> dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5335  
> dig sigok.verteiltesysteme.net @127.0.0.1 -p 5335  
> The first command should give a status report of SERVFAIL and no IP address. The second should give NOERROR plus an IP address.

From: [https://docs.pi-hole.net/guides/dns/unbound/#](https://docs.pi-hole.net/guides/dns/unbound/#)

## Actual Behaviour:

> pi@raspberrypi:~ $ dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5335
> 
> ; \<\<\>\> DiG 9.11.5-P4-5.1+deb10u5-Raspbian \<\<\>\> sigfail.verteiltesysteme.net @127.0.0.1 -p 5335  
> ;; global options: +cmd  
> ;; Got answer:  
> ;; -\>\>HEADER\<\<- opcode: QUERY, status: NOERROR, id: 11994  
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
> 
> ;; OPT PSEUDOSECTION:  
> ; EDNS: version: 0, flags:; udp: 1472  
> ;; QUESTION SECTION:  
> ;sigfail.verteiltesysteme.net. IN A
> 
> ;; ANSWER SECTION:  
> sigfail.verteiltesysteme.net. 60 IN A 134.91.78.139
> 
> ;; Query time: 174 msec  
> ;; SERVER: 127.0.0.1#5335(127.0.0.1)  
> ;; WHEN: Sat Oct 23 10:49:25 MDT 2021  
> ;; MSG SIZE rcvd: 73
> 
> pi@raspberrypi:~ $ dig sigok.verteiltesysteme.net @127.0.0.1 -p 5335
> 
> ; \<\<\>\> DiG 9.11.5-P4-5.1+deb10u5-Raspbian \<\<\>\> sigok.verteiltesysteme.net @127.0.0.1 -p 5335  
> ;; global options: +cmd  
> ;; Got answer:  
> ;; -\>\>HEADER\<\<- opcode: QUERY, status: NOERROR, id: 33132  
> ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
> 
> ;; OPT PSEUDOSECTION:  
> ; EDNS: version: 0, flags:; udp: 1472  
> ;; QUESTION SECTION:  
> ;sigok.verteiltesysteme.net. IN A
> 
> ;; ANSWER SECTION:  
> sigok.verteiltesysteme.net. 60 IN A 134.91.78.139
> 
> ;; Query time: 174 msec  
> ;; SERVER: 127.0.0.1#5335(127.0.0.1)  
> ;; WHEN: Sat Oct 23 10:49:35 MDT 2021  
> ;; MSG SIZE rcvd: 71
> 
> pi@raspberrypi:~ $

## Debug Token:

[https://tricorder.pi-hole.net/pFmCboBC/](https://tricorder.pi-hole.net/pFmCboBC/)

---

<div class="post-metadata">

**Author:** ![Chris\_Anthony](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/chris_anthony/32/15001_2.png) [@Chris\_Anthony](https://discourse.pi-hole.net/u/Chris_Anthony)\
**Post date:** [October 23, 2021, 4:57pm UTC](https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562/2 "2021-10-23T16:57:27Z")

</div>

Some aditional settings but still can't get Unbound DNSSEC to work correctly.

grep PIHOLE\_DNS /etc/pihole/setupVars.conf

> PIHOLE\_DNS\_1=127.0.0.1#5335

nslookup pi.hole

> Server: 127.0.0.1  
> Address: 127.0.0.1#53
> 
> Name: pi.hole  
> Address: 127.0.0.1  
> Name: pi.hole  
> Address: ::1

I am woundering if it's do to domain\_name\_servers being Googles DNS in /etc/dhcpcd.conf

> interface eth0  
> static ip\_address=192.168.1.5/24  
> static routers=192.168.1.1  
> static domain\_name\_servers=8.8.8.8 8.8.4.4

Pi Hole settings

 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/8/5/8598acf7a6fd48fbfe32a1cdd02d8258c1083ad2.png)

 ![image](https://discourse.pi-hole.net/uploads/default/original/3X/5/f/5f6486008da2b9fe5197dce177806447382866a4.png)

Can I use this for IPv6 for Unbound?

> ::1/128#5335

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [October 23, 2021, 5:14pm UTC](https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562/3 "2021-10-23T17:14:48Z")

</div>

> [@Chris\_Anthony](#):
>
> `PIHOLE_DNS_1=127.0.0.1#5335`

This is unrelated to how unbound performs. This tells Pi-hole to use unbound as the upstream DNS server, and that's all.

> [@Chris\_Anthony](#):
>
> nslookup pi.hole

This is locally served by Pi-hole and not forwarded to unbound for resolution/

> [@Chris\_Anthony](#):
>
> am woundering if it's do to domain\_name\_servers being Googles DNS in /etc/dhcpcd.conf

No. This setting specifies what DNS server the Pi should use, and is unrelated to the performance of unbound.

> [@Chris\_Anthony](#):
>
> Can I use this for IPv6 for Unbound?
> 
> > ::1/128#5335

Yes, but not in that format and not needed. Unbound can resolve both A and AAAA queries on IPv4 only. There is not need to add an IPv6 address. The existing IPv4 IP will suffice.

---

<div class="post-metadata">

**Author:** ![Chris\_Anthony](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/chris_anthony/32/15001_2.png) [@Chris\_Anthony](https://discourse.pi-hole.net/u/Chris_Anthony)\
**Post date:** [October 23, 2021, 5:29pm UTC](https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562/4 "2021-10-23T17:29:22Z")

</div>

That just means none of those settings are wrong but doesn't explain why I'm not getting a SERVFAIL as expected with:

> dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5335

---

<div class="post-metadata">

**Author:** ![Chris\_Anthony](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/chris_anthony/32/15001_2.png) [@Chris\_Anthony](https://discourse.pi-hole.net/u/Chris_Anthony)\
**Post date:** [October 23, 2021, 7:08pm UTC](https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562/5 "2021-10-23T19:08:56Z")

</div>

Using

> /var/lib/unbound/root.hints

instead of

> dns-root- data

Made no difference still no SERVFAIL where one is expected.

---

<div class="post-metadata">

**Author:** ![Chris\_Anthony](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/chris_anthony/32/15001_2.png) [@Chris\_Anthony](https://discourse.pi-hole.net/u/Chris_Anthony)\
**Post date:** [October 23, 2021, 7:56pm UTC](https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562/6 "2021-10-23T19:56:07Z")

</div>

I finaly found a fix for this and looks like some directions are missing from [https://docs.pi-hole.net/guides/dns/unbound](https://docs.pi-hole.net/guides/dns/unbound).

## Fix Unbound Service Erroring out

I couldn't get unbound to run until adding a line to the _/etc/unbound/unbound.conf_

> include: "/etc/unbound/unbound.conf.d/\*.conf"

This will allow unbound to look at _/etc/unbound/unbound.conf.d/pi-hole.conf_ as used in the documentation.

Unbound will launch but was still unable to validate DNSSEC.

## To Fix Unbound DNSSEC Validating

Run **sudo unbound-anchor** to create a _root.key_ file (mine ended up being in /var/lib/unbound). Add the following line to _/etc/unbound/unbound.conf_

> auto-trust-anchor-file: "/var/lib/unbound/root.key"

Now I restarted the unbound service and I also restarted the dhcpcd service (but likely not required).

> sudo service unbound restart  
> sudo systemctl restart dhcpcd

the dig commands are now working as expected from the documentstion.

> dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5335  
> dig sigok.verteiltesysteme.net @127.0.0.1 -p 5335

The first command should give a status report of SERVFAIL and no IP address. The second should give NOERROR plus an IP address.

### Linked Resources

[Pi-hole documentation - Unbound](https://docs.pi-hole.net/guides/dns/unbound/#)  
[Error installing unbound on new PI 4](https://discourse.pi-hole.net/t/error-installing-unbound-on-new-pi-4/25121/11)  
[Reddit - help\_with\_unbound\_running\_with\_pihole](https://www.reddit.com/r/pihole/comments/el9e22/help_with_unbound_running_with_pihole/fdi3789/)  
[DNSSEC Validation with Unbound on a Raspberry](https://weberblog.net/dnssec-validation-with-unbound-on-a-raspberry/)

---

<div class="post-metadata">

**Author:** ![Chris\_Anthony](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/chris_anthony/32/15001_2.png) [@Chris\_Anthony](https://discourse.pi-hole.net/u/Chris_Anthony)\
**Post date:** [October 23, 2021, 9:36pm UTC](https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562/7 "2021-10-23T21:36:38Z")

</div>

It looks like IPv6 isn't working though 😢

dig AAAA ipv6.google.com @127.0.0.1 -p 5353

 ![Screenshot_20211023-153527](https://discourse.pi-hole.net/uploads/default/original/3X/4/8/48662e1f8d2bbc36ba81f36e6d51b7182bbfb7be.jpeg)

I do have my config file set to: _do-ip6: yes_

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [October 23, 2021, 9:42pm UTC](https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562/8 "2021-10-23T21:42:59Z")

</div>

You're not using IPv6 to send that query to `unbound`. You're using IPv4 (127.0.0.1) and asking for an AAAA record, which is perfectly legal.

Getting a response of 'no servers could be reached' means that `unbound` is not listening on port 5353 on the localhost interface. Which is highly likely since the guide uses 5335 and not 5353 for the port.

Try your dig again with 5335 instead.

---

<div class="post-metadata">

**Author:** ![Chris\_Anthony](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/chris_anthony/32/15001_2.png) [@Chris\_Anthony](https://discourse.pi-hole.net/u/Chris_Anthony)\
**Post date:** [October 23, 2021, 9:50pm UTC](https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562/10 "2021-10-23T21:50:36Z")

</div>

Before I had this working [https://en.internet.nl/connection](https://en.internet.nl/connection) reported IPV6 as working but now that I have unbound working it reports

> Modern addresses not reachable (IPv6)

---

<div class="post-metadata">

**Author:** ![Chris\_Anthony](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/chris_anthony/32/15001_2.png) [@Chris\_Anthony](https://discourse.pi-hole.net/u/Chris_Anthony)\
**Post date:** [October 23, 2021, 9:54pm UTC](https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562/11 "2021-10-23T21:54:38Z")

</div>

> [@DanSchaper](#):
>
> dig again with 5335 instead.

dig again 5335 and everything is working grate. Thank you for the help. I deleated my old posts after this one because the issue was the device and not the pi hole.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [November 13, 2021, 10:07pm UTC](https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562/13 "2021-11-13T22:07:06Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.