<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">I was able to use</div><div class=""><br class=""></div><div class=""><div class="" style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span class="" style="font-variant-ligatures: no-common-ligatures;">forward-zone:</span></div><div class="" style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span class="" style="font-variant-ligatures: no-common-ligatures;"><span class="Apple-tab-span" style="white-space: pre;"> </span>name: "<a href="http://spamhaus.org" class="">spamhaus.org</a>"</span></div><div class="" style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: Menlo;"><span class="" style="font-variant-ligatures: no-common-ligatures;"><span class="Apple-tab-span" style="white-space: pre;"> </span>forward-addr: 127.0.0.1@1053 # do not resolve spamhaus via public DNS resolvers</span></div></div><div class=""><span class="" style="font-variant-ligatures: no-common-ligatures;"><br class=""></span></div><div class="">Because I have a <i class="">second</i> non-forwarding unbound running on port 1053 for rspamd already (which has more or less the same issue, but which — unlike postfix — can be told to use a different name server itself)</div><div class=""><br class=""></div><div class="">So, for <a href="http://spamhaus.org" class="">spamhaus.org</a> alone, I forward to my own second unbound which does not forward to quad9.</div><div class=""><br class=""></div><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div><div class="">Gerben Wierda (<a href="https://www.linkedin.com/in/gerbenwierda" class="">LinkedIn</a>)</div><div class=""><a href="https://ea.rna.nl/" class="">R&A IT Strategy</a> (main site)<br class="">Book: <a href="https://ea.rna.nl/the-book/" class="">Chess and the Art of Enterprise Architecture</a><br class="">Book: <a href="https://ea.rna.nl/the-book-edition-iii/" class="">Mastering ArchiMate</a><br class=""></div></div></div></div></div></div></div></div></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On 5 Mar 2022, at 18:40, A. Schulze via Unbound-users <<a href="mailto:unbound-users@lists.nlnetlabs.nl" class="">unbound-users@lists.nlnetlabs.nl</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><br class="">Am 05.03.22 um 02:36 schrieb Gerben Wierda via Unbound-users:<br class=""><blockquote type="cite" class="">I am using unbound and it is configured to use cloud9 as a forwarder.<br class=""><br class="">But <a href="http://spamhaus.org" class="">spamhaus.org</a> <<a href="http://spamhaus.org" class="">http://spamhaus.org</a>> DNSBL will not answer requests for IP addresses from public DNS, such as cloud9.<br class=""><br class="">So, what I would like to do is configure unbound in such a way that it always goes to cloud9, except when the query is about <a href="http://spamhaus.org" class="">spamhaus.org</a> <<a href="http://spamhaus.org" class="">http://spamhaus.org</a>>. Can I do that?<br class=""></blockquote><br class="">Hello Gerben,<br class=""><br class="">I'm not aware, unbound support a mode "forward all but [list of domains]"<br class=""><br class="">My expectation: unbound is a recursive resolver and should know to which nameservers query for [list of domains] must be sent.<br class="">There is no option known to me to configure unbound this way.<br class=""><br class="">But it is possible to forward all to one recursive resolver and send queries for some zones to a list of known other name servers.<br class=""><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>forward-zone:<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span> name: "."<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span> forward-addr: 9.9.9.9<br class=""><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span>stub-zone:<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span> name: "<a href="http://nlnetlabs.nl" class="">nlnetlabs.nl</a>."<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span> stub-host: "<a href="http://ns.nlnetlabs.nl" class="">ns.nlnetlabs.nl</a>."<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span> stub-host: "<a href="http://ns-ext1.sidn.nl" class="">ns-ext1.sidn.nl</a>."<br class=""><span class="Apple-tab-span" style="white-space:pre"> </span> stub-host: "<a href="http://anyns.pch.net" class="">anyns.pch.net</a>."<br class=""><br class="">The downside of such configurations:<br class="">- stub-host will be resolved via 9.9.9.9<br class="">- stub-host must be outside the stub-zone<br class="">- stub-addr may be used to circumvent this limitation<br class="">- you MUST list a correct set of nameservers (names or addresses)<br class=""> To be more robust against changed nameserver sets, you should enable "stub-prime: yes"<br class="">h<br class="">Andreas<br class=""></div></div></blockquote></div><br class=""></body></html>