Re: [PATCH] DNS: Fall back to permissive mode if recursor mode is unavailable

[Michael Tremer <michael.tremer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 2099 bytes --]

Hi,

On Mon, 2017-03-06 at 12:18 -0600, Paul Simmons wrote:
> On Sun, 2017-03-05 at 11:42 +0000, Michael Tremer wrote:
> > 
> > Hi,
> > 
> > can you confirm if unbound is running?
> > 
> > What is the output of /etc/init.d/unbound restart?
> > 
> > -Michael
> > 
> > > 
> > > > 
> > > > > 
> > > > > ----<% snip %>----
> > > > 
> > > > I have nightly commit c016773b9816ad9be4ffc8643c30457e87c094e3
> > > > available locally, and will beg my users for downtime to test.
> > > > 
> > > > Thank you, and best regards,
> > > > Paul
> > > > 
> > > > 
> > > 
> > > Bad juju - build c016773b couldn't resolve any hosts (other than
> > > those in "localdomain").
> > > 
> > > Provider is "hughes.net" and is the only ISP available (no
> > > hardlines
> > > or other LOS/NLOS WISPs available).
> > > 
> > > Tried assigning DNS servers 74.113.60.185 and 156.154.70.1 - no
> > > change.
> > > 
> > > Paul
> > > 
> 
> Sorry for the lllooonnnggg delay - had to get a testing time window.
> 
> Unbound was indeed running - verified with "/etc/init.d/unbound status"
> 
> Command and output from "restart":
> 
> # /etc/init.d/unbound restart
> Stopping Unbound DNS
> Proxy...                                          [  OK  ]
> Starting Unbound DNS
> Proxy...                                          [  OK  ]
> Ignoring broken upstream name server(s): 74.113.60.185
> 156.154.70.1    [ WARN ]
> Falling back to recursor
> mode                                          [ WARN ]

So, can you remind me what your provider does again? Is any access to other name
servers forbidden? If so the updated script should have detected that and should
not have activated the recursor mode.

Could you manually execute the following commands from the console of IPFire for
me?

  dig @198.41.0.4 +dnssec SOA .

The dot at the end is important. What is the output of it?

Best,
-Michael

> 
> 
> Thank you,
> Paul

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]