# Unbound DNSSEC validation not working

**URL:** <https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562>\
**Category:** Help\
**Created:** [October 23, 2021, 4:50pm UTC](https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562 "2021-10-23T16:50:02Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![Chris\_Anthony](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/chris_anthony/32/15001_2.png) [@Chris\_Anthony](https://discourse.pi-hole.net/u/Chris_Anthony)\
**Post date:** [October 23, 2021, 7:56pm UTC](https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562/6 "2021-10-23T19:56:07Z")

</div>

I finaly found a fix for this and looks like some directions are missing from [https://docs.pi-hole.net/guides/dns/unbound](https://docs.pi-hole.net/guides/dns/unbound).

## Fix Unbound Service Erroring out

I couldn't get unbound to run until adding a line to the _/etc/unbound/unbound.conf_

> include: "/etc/unbound/unbound.conf.d/\*.conf"

This will allow unbound to look at _/etc/unbound/unbound.conf.d/pi-hole.conf_ as used in the documentation.

Unbound will launch but was still unable to validate DNSSEC.

## To Fix Unbound DNSSEC Validating

Run **sudo unbound-anchor** to create a _root.key_ file (mine ended up being in /var/lib/unbound). Add the following line to _/etc/unbound/unbound.conf_

> auto-trust-anchor-file: "/var/lib/unbound/root.key"

Now I restarted the unbound service and I also restarted the dhcpcd service (but likely not required).

> sudo service unbound restart  
> sudo systemctl restart dhcpcd

the dig commands are now working as expected from the documentstion.

> dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5335  
> dig sigok.verteiltesysteme.net @127.0.0.1 -p 5335

The first command should give a status report of SERVFAIL and no IP address. The second should give NOERROR plus an IP address.

### Linked Resources

[Pi-hole documentation - Unbound](https://docs.pi-hole.net/guides/dns/unbound/#)  
[Error installing unbound on new PI 4](https://discourse.pi-hole.net/t/error-installing-unbound-on-new-pi-4/25121/11)  
[Reddit - help\_with\_unbound\_running\_with\_pihole](https://www.reddit.com/r/pihole/comments/el9e22/help_with_unbound_running_with_pihole/fdi3789/)  
[DNSSEC Validation with Unbound on a Raspberry](https://weberblog.net/dnssec-validation-with-unbound-on-a-raspberry/)

---

_[View the full topic](https://discourse.pi-hole.net/t/unbound-dnssec-validation-not-working/50562)._