Unbound doesn't work

[deHakkelaar]

@hadifarnoud

However, sometimes lookup for . returns nothing. I didn't figure out why.

sudo unbound-control lookup .
The following name servers are used for lookup of .
no delegation from cache; goes to configured roots

Thats odd.
Those "." and "XXX.root-servers.net" records should stay cached by unbound for at least 44236 seconds (approximately 12 hours):

@hadifarnoud

. 44236 IN NS g.root-servers.net.

If you get that "no delegation from cache" message intermittently within those 12 hours, it sounds as if unbound gets restarted or some other process that clears cache.

Does your Pi-hole host have an IPv6 GUA address?

ip -br -6 a

IPv6 | Global addressing

Dont post your full global address here for privacy but partially redact it eg 2001:XXXX !!!

If the host got an IPv6 global address via IPv6 SLAAC/NDRA, the router might periodicly change the prefix (coming from your ISP) via IPv6 router advertisement(RA).
Whenever the advertised prefix changes, the IP changes.
And when the IP changes, unbound gets restarted.
A rudimentary way of purging the old IPv6 details that were in cache.
I dont have IPv6 at home but thats what I could make up from below:

Unbound frequent restarts

I know this is an old issue, but I am currently an issue where unbound on the pihole restarts every few hours due to the router advertisments. I tried setting a static IPV6 address for the pihole on pfsense but that didn't seem to help. Did anyone have luck resolving this? May 27 03:19:58 raspberrypi dhcpcd[462]: eth0: part of Router Advertisement expired May 27 03:19:59 raspberrypi unbound: [536:0] info: service stopped (unbound 1.9.0). May 27 03:19:59 raspberrypi unbound: [536:0] info: start…

Do you see unbound getting restarted frequently with below?

journalctl --full --no-pager -b -u unbound

@hadifarnoud

btw, this is what I see on Pihole log. what does "INSECURE" means?

See below:

https://docs.pi-hole.net/ftldns/dnsmasq_warn/?h=insecure