<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<blockquote type="cite"
cite="mid:a0a686a5-3e64-9d4a-8354-501632f485f6@andreasschulze.de">the
following configuration is known to work with unbound 1.8.x</blockquote>
<br>
Seems it does not make a difference whether it is 1.7.3 or 1.8.x<br>
<br>
<blockquote type="cite"
cite="mid:a0a686a5-3e64-9d4a-8354-501632f485f6@andreasschulze.de">
<pre class="moz-quote-pre" wrap="">auth-zone:
name: "."</pre>
</blockquote>
<br>
The syntax <b>""</b> for <b>name: </b>is not stipulated in the
online documentation, that is for <b>auth-zone:</b>. Why is it
being used then? unbound-checkconf does not report an error either
way, i.e. whether it reads <b>name: "."</b> or <b>name: .</b>, and
the outcome of the query is the same.<br>
<br>
<blockquote type="cite"
cite="mid:a0a686a5-3e64-9d4a-8354-501632f485f6@andreasschulze.de">
<pre class="moz-quote-pre" wrap=""> for-downstream: no</pre>
</blockquote>
<br>
That does not make sense to me considering the purpose of
transferring the root zone-> "If enabled, unbound serves
authority responses to downstream clients for this zone. This
option <i>makes unbound behave</i>, for the queries with names in
this zone,<i> like one of the authority servers for that zone</i>."<br>
<br>
Setting it to <b>no</b> is defeating that purpose as a query does
not resolve the SLD either:<br>
<br>
<blockquote type="cite"># dig bbc.com<br>
<br>
; <<>> DiG 9.11.2-P1 <<>> bbc.com<br>
;; global options: +cmd<br>
;; Got answer:<br>
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id:
34029<br>
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL:
1<br>
<br>
;; OPT PSEUDOSECTION:<br>
; EDNS: version: 0, flags:; udp: 4096<br>
;; QUESTION SECTION:<br>
;bbc.com. IN A<br>
<br>
;; Query time: 5 msec<br>
;; SERVER: 127.0.0.1#53(127.0.0.1)<br>
;; WHEN: Sun Oct 28 18:40:37 CET 2018<br>
;; MSG SIZE rcvd: 36</blockquote>
<br>
<br>
<blockquote type="cite"
cite="mid:a0a686a5-3e64-9d4a-8354-501632f485f6@andreasschulze.de">
<pre class="moz-quote-pre" wrap=""> for-upstream: yes</pre>
</blockquote>
<br>
According to the online documentation this is a default setting and
thus redundant to my understanding.<br>
<br>
<br>
<blockquote type="cite"
cite="mid:a0a686a5-3e64-9d4a-8354-501632f485f6@andreasschulze.de">
<pre class="moz-quote-pre" wrap=""> fallback-enabled: yes
</pre>
</blockquote>
<br>
Only then the SLD resolves but that renders the transfer of the root
zone redundant, i.e. means there is no apparent benefit/advantage of
having a local the root zone with its delegated TLDs.<br>
<br>
The purpose of featuring a local copy of the root zone was that TLD
queries are served locally rather than generating upstream queries
to the NS of the TLD and thus mitigating the amount of upstream
queries to authoritative servers and speed up lookups but also to
enhance privacy for client queries.<br>
<br>
<br>
</body>
</html>