<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">No, this is about certain DNS servers not accepting queries from public resolvers, such as DNS servers that are used to disseminate information about bad actors. DNS blacklists and all that. </div><div class=""><br class=""></div><div class="">My standard LAN resolver (unbound) forwards to cloud9 (9.9.9.9) so I am protected by their filtering of bad domains. But requests from rspamd and postfix cannot use that setup. rspamd does not accept requests from a public DNS such as 9.9.9.9. And neither does <a href="http://zen.apamhaus.org" class="">zen.apamhaus.org</a> that provides a DNSBL that can be used in the postfix setup.</div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; line-height: normal;" class=""><span style="font-family: Menlo; font-size: 11px; font-variant-ligatures: no-common-ligatures;" class="">main.cf:<span class="Apple-tab-span" style="white-space:pre"> </span>postscreen_dnsbl_sites </span><font face="Menlo" class=""><span style="font-size: 11px;" class="">= z</span></font><a href="http://en.spamhaus.org" class="">en.spamhaus.org</a> =<span style="font-family: Menlo; font-size: 11px;" class="">127.0.0.[2..11]</span></div></div><div class=""><br class=""></div><div class="">rspamd has a setting to direct it to a different DNS. To make use of that but still offer the 9.9.9.9 protection to all clients in my LAN, I had to set up a second unbound running on a different port (1053) on localhost. That way, I can tell rspamd </div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">options.inc: nameserver = "127.0.0.1:1053";</span></div></div><div class=""><br class=""></div><div class="">And rspamd is now not indirectly using 9.9.9.9 while the rest is. But postfix doesn’t have such a setting. So, <a href="http://zen.spamhaus.org" class="">zen.spamhaus.org</a> doesn’t work. I was able to use</div><div class=""><br class=""></div><div class=""><div class="" style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span class="" style="font-variant-ligatures: no-common-ligatures;">forward-zone:</span></div><div class="" style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span class="" style="font-variant-ligatures: no-common-ligatures;"><span class="Apple-tab-span" style="white-space: pre;"> </span>name: "<a href="http://spamhaus.org" class="">spamhaus.org</a>"</span></div><div class="" style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span class="" style="font-variant-ligatures: no-common-ligatures;"><span class="Apple-tab-span" style="white-space: pre;"> </span>forward-addr: 127.0.0.1@1053 # do not resolve spamhaus via public DNS resolvers</span></div></div><div class=""><span class="" style="font-variant-ligatures: no-common-ligatures;"><br class=""></span></div><div class="">Because I already had that second non-forwarding unbound running on port 1053 for rspamd.</div><div class=""><br class=""></div><div class="">I also am running NSD for the local private addresses, but that doesn’t end up here, other than that NSD wants to run on the same port as unbound (53) so my NSD runs on port 54 and unbound has:</div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""># The authorative NSD for <a href="http://rna.nl/192.168.2.x" class="">rna.nl/192.168.2.x</a> is on this machine (127.0.0.1@54)</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">stub-zone:</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> name: "<a href="http://rna.nl" class="">rna.nl</a>"</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> stub-addr: 127.0.0.1@54</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class="">stub-zone:</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> name: "2.168.192.in-addr.arpa"</span></div><div style="margin: 0px; font-stretch: normal; font-size: 10px; line-height: normal; font-family: Monaco;" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""> stub-addr: 127.0.0.1@54</span></div><div class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><br class=""></span></div></div><div class="">Basically, that gies me the split-DNS, where external resolving of <a href="http://rna.nl" class="">rna.nl</a> and internal resolving of anything on rna.nl work, some more hosts internally than externally of course.</div><div class=""><br class=""></div><div class="">My question about local addresses was directed at another possible scenario: make sure that requests to unbound from one set of addresses does forwarding and another (the server itself) does not. But the solution I now have is better. For instance, domains not resolved by 9.9.9.9 because they are bad actors also do not resolve in postfix and get dropped because they do not have a decent DNS/reverse set up, even if they have.</div><div class=""><br class=""></div><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div><div class="">Gerben Wierda (<a href="https://www.linkedin.com/in/gerbenwierda" class="">LinkedIn</a>)</div><div class=""><a href="https://ea.rna.nl/" class="">R&A IT Strategy</a> (main site)<br class="">Book: <a href="https://ea.rna.nl/the-book/" class="">Chess and the Art of Enterprise Architecture</a><br class="">Book: <a href="https://ea.rna.nl/the-book-edition-iii/" class="">Mastering ArchiMate</a><br class=""></div></div></div></div></div></div></div></div></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On 5 Mar 2022, at 07:17, Steven Wills <<a href="mailto:steven@swills.me" class="">steven@swills.me</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div style="font-family: arial; font-size: 14px;" class="">I re read your emails and you mention "local" IP addresses. Maybe a stub-zone is what you're after? But I don't think that is the case since a stub zone is meant to point to an authoritative server. Maybe someone with a better idea of what you're asking can weigh in.</div><div style="font-family: arial; font-size: 14px;" class=""><br class=""></div><div style="font-family: arial; font-size: 14px;" class="">I use a stub-zone to point to my NSD server.<br class=""><span class=""><br class=""></span></div><div style="font-family: arial; font-size: 14px;" class=""><span class="">stub-zone:</span><div class=""><span class=""> name: "<a href="http://swills.org" class="">swills.org</a>"</span></div><div class=""><span class=""> stub-addr: 10.0.10.25</span></div><span class=""></span><br class=""></div><div style="font-family: arial; font-size: 14px;" class=""><br class=""></div><div style="font-family: arial; font-size: 14px;" class=""><span class=""><a target="_blank" rel="noreferrer nofollow noopener" href="https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html?highlight=stub%20zone#stub-zone-options" class="">https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html?highlight=stub%20zone#stub-zone-options</a></span></div><div style="font-family: arial; font-size: 14px;" class=""><br class=""></div><div style="font-family: arial; font-size: 14px;" class="">Thanks again,</div><div style="font-family: arial; font-size: 14px;" class="">Steven<br class=""></div>
<div class="protonmail_signature_block protonmail_signature_block-empty" style="font-family: arial; font-size: 14px;">
<div class="protonmail_signature_block-user protonmail_signature_block-empty">
</div>
<div class="protonmail_signature_block-proton protonmail_signature_block-empty">
</div>
</div>
<div style="font-family: arial; font-size: 14px;" class=""><br class=""></div><div style="font-family: arial; font-size: 14px;" class=""><br class=""></div><div class="protonmail_quote">
------- Original Message -------<br class="">
On Friday, March 4th, 2022 at 20:14, Gerben Wierda <<a href="mailto:gerben.wierda@rna.nl" class="">gerben.wierda@rna.nl</a>> wrote:<br class=""><br class="">
<blockquote class="protonmail_quote" type="cite">
Yes, that is what I thought a while back, so I decided at the time to test with this:<div class=""><br class=""></div><div class=""><div class="" style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><div class="" style="margin: 0px; font-stretch: normal; line-height: normal;"><span class="" style="font-variant-ligatures: no-common-ligatures">forward-zone:</span></div><div class="" style="margin: 0px; font-stretch: normal; line-height: normal;"><span class="" style="font-variant-ligatures: no-common-ligatures"> name: "<a class="" href="http://apple.com/" rel="noreferrer nofollow noopener" target="_blank">apple.com</a>."</span></div><div class="" style="margin: 0px; font-stretch: normal; line-height: normal;"><span class="" style="font-variant-ligatures: no-common-ligatures"> forward-addr: 8.8.8.8@53 # testing if I can forward based on fqdn</span></div><div class="" style="margin: 0px; font-stretch: normal; line-height: normal;"><br class=""></div><div class="" style="margin: 0px; font-stretch: normal; line-height: normal;">forward-zone:</div><div class="" style="margin: 0px; font-stretch: normal; line-height: normal;"><span class="" style="font-variant-ligatures: no-common-ligatures"> name: "."</span></div><div class="" style="margin: 0px; font-stretch: normal; line-height: normal;"><span class="" style="font-variant-ligatures: no-common-ligatures"> # If the forwarding fails, do your own recursion</span></div><div class="" style="margin: 0px; font-stretch: normal; line-height: normal;"><span class="" style="font-variant-ligatures: no-common-ligatures"> forward-first: yes</span></div><div class="" style="margin: 0px; font-stretch: normal; line-height: normal;"><span class="" style="font-variant-ligatures: no-common-ligatures"> # Quad9 phising/malware site blocking DNS 9.9.9.9</span></div><div class="" style="margin: 0px; font-stretch: normal; line-height: normal;"><span class="" style="font-variant-ligatures: no-common-ligatures"> forward-addr: 9.9.9.9</span></div><div class=""><span class="" style="font-variant-ligatures: no-common-ligatures"><br class=""></span></div></div></div><div class="">to see if that worked, but all the request kept being forwarded to 9.9.9.9 at the time. I gave up at the time (for another reason) but now I need it again.</div><div class=""><br class=""><div class="">
<div class="" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" dir="auto"><div class="" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" dir="auto"><div class="" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" dir="auto"><div class="" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" dir="auto"><div class="" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" dir="auto"><div class="" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" dir="auto"><div class="" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" dir="auto"><div class=""><div class="">Gerben Wierda (<a class="" href="https://www.linkedin.com/in/gerbenwierda" rel="noreferrer nofollow noopener" target="_blank">LinkedIn</a>)</div><div class=""><a class="" href="https://ea.rna.nl/" rel="noreferrer nofollow noopener" target="_blank">R&A IT Strategy</a> (main site)<br class="">Book: <a class="" href="https://ea.rna.nl/the-book/" rel="noreferrer nofollow noopener" target="_blank">Chess and the Art of Enterprise Architecture</a><br class="">Book: <a class="" href="https://ea.rna.nl/the-book-edition-iii/" rel="noreferrer nofollow noopener" target="_blank">Mastering ArchiMate</a><br class=""></div></div></div></div></div></div></div></div></div>
</div>
<div class=""><br class=""><blockquote class="" type="cite"><div class="">On 5 Mar 2022, at 03:03, Steven Wills <<a class="" href="mailto:steven@swills.me" rel="noreferrer nofollow noopener" target="_blank">steven@swills.me</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">Hello,<br class=""><br class="">I think what you want is a Forward Zone.<br class=""><br class=""><br class=""><a class="" href="https://docs.netgate.com/tnsr/en/latest/dns/fwd-zone.html" rel="noreferrer nofollow noopener" target="_blank">https://docs.netgate.com/tnsr/en/latest/dns/fwd-zone.html</a><br class=""><br class="">Thank you,<br class="">Steven<br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class="">-------- Original Message --------<br class="">On Mar 4, 2022, 19:36, Gerben Wierda via Unbound-users < <a class="" href="mailto:unbound-users@lists.nlnetlabs.nl" rel="noreferrer nofollow noopener" target="_blank">unbound-users@lists.nlnetlabs.nl</a>> wrote:<blockquote class="protonmail_quote"><br class=""><div class="">I am using unbound and it is configured to use cloud9 as a forwarder.<div class=""><br class=""></div><div class="">But <a class="" href="http://spamhaus.org/" rel="noreferrer nofollow noopener" target="_blank">spamhaus.org</a> DNSBL will not answer requests for IP addresses from public DNS, such as cloud9.</div><div class=""><br class=""></div><div class="">So, what I would like to do is configure unbound in such a way that it always goes to cloud9, except when the query is about <a class="" href="http://spamhaus.org/" rel="noreferrer nofollow noopener" target="_blank">spamhaus.org</a>. Can I do that?</div><div class=""><br class=""></div><div class="">If that is not possible, I would like to configure unbound that is forwards everything to cloud9, unless it comes from a specific set of local IP addresses. Is that possible?</div><div class=""><br class=""></div><div class="">Thanks,</div><div class=""><br class=""><div class=""><div class="">
<div class="" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" dir="auto"><div class="" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" dir="auto"><div class="" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" dir="auto"><div class="" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" dir="auto"><div class="" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" dir="auto"><div class="" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" dir="auto"><div class="" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" dir="auto"><div class=""><div class="">Gerben Wierda (<a class="" href="https://www.linkedin.com/in/gerbenwierda" rel="noreferrer nofollow noopener" target="_blank">LinkedIn</a>)</div><div class=""><a class="" href="https://ea.rna.nl/" rel="noreferrer nofollow noopener" target="_blank">R&A IT Strategy</a> (main site)<br class="">Book: <a class="" href="https://ea.rna.nl/the-book/" rel="noreferrer nofollow noopener" target="_blank">Chess and the Art of Enterprise Architecture</a><br class="">Book: <a class="" href="https://ea.rna.nl/the-book-edition-iii/" rel="noreferrer nofollow noopener" target="_blank">Mastering ArchiMate</a><br class=""></div></div></div></div></div></div></div></div></div>
</div>
<br class=""></div></div></div></blockquote></div></blockquote></div><br class=""></div>
</blockquote><br class="">
</div></div></blockquote></div><br class=""></body></html>