<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi,<div class=""><br class=""></div><div class="">I’m kind of stuck with this problem. Hashicorp's consul doesn’t support DNSSEC and as such, I can’t forward from my main bind instance (DNSSEC enabled) to the consul daemon directly. I can’t turn off DNSSEC in the bind instance either.</div><div class=""><br class=""></div><div class="">Instead, my naive plan is to:</div><div class=""><ul class="MailOutline"><li class="">Instruct bind to forward requests for the consul domain to unbound. They can use DNSSEC for this step.</li><li class="">Once unbound receives the request from bind, instruct unbound to forward it further to consul (no DNSSEC).</li><li class="">Retrieve the answer from consul and give it back to bind.</li></ul><div class=""><br class=""></div></div><div class="">Basically, I want to hide a DNS server (consul) that can’t speak DNSSEC behind unbound.</div><div class=""><br class=""></div><div class="">Is that possible?</div><div class=""><br class=""></div><div class="">Thanks!</div><div class=""> Sergei</div></body></html>