<HTML><BODY><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">I have two large enough (150-200 hosts) segments of internal network, 10.XXX.0.0 and 10.YYY.0.0. They are linked through Internet, speed is not like local but high enough - about 50Mb/s. I used two authoritative bind servers and three (two in one segment, one in the second) recursive also bind ones. For making bind, unbound and nsd configuration and zone files I'm using hostdb package, so all authoritative and recursive servers are generated and distributed to at once by the hostdb.</span><div><div><div><div><div><div><div><div><div><div><div id="style_16802365310673291969_BODY"><div><div><div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">Now I like to reconstruct dns. I've created in place of my three recursive servers three combined ones with unbound and nsd which local only listen on separate port.</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">This works fine first several minutes after reload unbound, and then for local names - SERVFAIL all the configured stub or forward servers failed, at zone abc.local. At the same time, Internet names continue to be resolved normally.</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">Unbound:</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">server:</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> interface: 0.0.0.0</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> do-not-query-localhost: no</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> </span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">stub-zone:</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> name: "abc.local"</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> stub-addr: 127.0.0.1@5678</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> </span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">stub-zone:</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> name: "10.in-addr.arpa."</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> stub-addr: 127.0.0.1@5678</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> </span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">forward-zone:</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> name: "."</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> forward-addr: 8.8.8.8</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> </span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">I'm not sure which is the source of this problem - unbound or nsd. Nsd has no such diagnostic, but dig -p 5678 @127.0.0.1 localname.abc.local works fine.</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> </span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">It is difficult to catch the moment when it starts to SERVFAIL.</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">Looks like some resources are running out.</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> </span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">I've returned two separated authoritative servers, so now it is like:</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">stub-zone:</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> name: "abc.local"</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> stub-addr: 127.0.0.1@5678</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> stub-addr: ipofauthserver1</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> stub-addr: ipofauthserver2</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> </span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">Despite that there are not many hosts within the network, there are about 10,000 names in local DNS zones.</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> </span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">All my dns servers are OpenBSD 6.5-7.0 64 bit virtual machines which are running in several free ESXi 5.5 and 7.3 servers.</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">Unbound 1.8.1 — 1.13.2</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> </span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">Does anybody bump in the same situation when unbound after several minutes of normal work stops resolve local names with SERVFAIL if it has only one local nsd source of local names?</span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">I think such configuration with unbound + nsd on one host is reasonable for home users for example.</span></div></div></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;"> </span></div><div><span style="max-width: 2150px; --left-column-width: 232px; --right-column-width: 252px; --sidebar-column-width: 320px;">Regards<br>Dmitri Stepanov</span></div></div></div></div></div></div></div></div></div></div></div></div></div></div></BODY></HTML>