<div dir="ltr">Thanks for the detailed information </div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Tue, May 6, 2025 at 12:00 PM <<a href="mailto:unbound-users-request@lists.nlnetlabs.nl">unbound-users-request@lists.nlnetlabs.nl</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Send Unbound-users mailing list submissions to<br>
<a href="mailto:unbound-users@lists.nlnetlabs.nl" target="_blank">unbound-users@lists.nlnetlabs.nl</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.nlnetlabs.nl/mailman/listinfo/unbound-users" rel="noreferrer" target="_blank">https://lists.nlnetlabs.nl/mailman/listinfo/unbound-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:unbound-users-request@lists.nlnetlabs.nl" target="_blank">unbound-users-request@lists.nlnetlabs.nl</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:unbound-users-owner@lists.nlnetlabs.nl" target="_blank">unbound-users-owner@lists.nlnetlabs.nl</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Unbound-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: ECS implementation in Unbound and Privacy Concerns<br>
(Yorgos Thessalonikefs)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Mon, 5 May 2025 15:19:42 +0200<br>
From: Yorgos Thessalonikefs <<a href="mailto:yorgos@nlnetlabs.nl" target="_blank">yorgos@nlnetlabs.nl</a>><br>
To: <a href="mailto:unbound-users@lists.nlnetlabs.nl" target="_blank">unbound-users@lists.nlnetlabs.nl</a><br>
Subject: Re: ECS implementation in Unbound and Privacy Concerns<br>
Message-ID: <<a href="mailto:9001365d-0daa-4261-aa60-54ab0f7e2d72@nlnetlabs.nl" target="_blank">9001365d-0daa-4261-aa60-54ab0f7e2d72@nlnetlabs.nl</a>><br>
Content-Type: text/plain; charset=UTF-8; format=flowed<br>
<br>
Hi Isaac,<br>
<br>
I believe this message comes from running unbound-checkconf.<br>
The message there was less clear than running unbound itself; I have <br>
synced both messages now to make more sense:<br>
<a href="https://github.com/NLnetLabs/unbound/commit/5dd14e26443a3801eea1e04cd650822183fe4762" rel="noreferrer" target="_blank">https://github.com/NLnetLabs/unbound/commit/5dd14e26443a3801eea1e04cd650822183fe4762</a><br>
<br>
The error is there because the subnetcache module is not compiled in by <br>
default.<br>
If you want to compile it you need to use '--enable-subnet' in your <br>
./configure line.<br>
<br>
With all that said, are you sure ECS is going to help in your use case?<br>
ECS is only useful when the resolver and the clients are on different <br>
regions; think open public resolvers.<br>
<br>
If that is not your use case and instead Unbound is close to the clients <br>
it serves, ECS will hamper performance for no real benefit.<br>
<br>
As for ECS and privacy concerns, you can read the ECS section in the <br>
manpage or also online at <br>
<a href="https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#edns-client-subnet-module-options" rel="noreferrer" target="_blank">https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#edns-client-subnet-module-options</a> <br>
for the latest version.<br>
Unbound by default masks /24 for IPv4 and /56 for IPv6 (the max-client-* <br>
options).<br>
<br>
Performance is impacted because of the extra caching functionality ECS <br>
imposes (cache per IP network segments), and the singularity of the <br>
client queries since different networks may yield different responses <br>
for the same query. That means queries that could have been aggregated <br>
without ECS because they have the same question, with ECS they are <br>
treated as separate queries because their client information may yield <br>
different results.<br>
<br>
Best regards,<br>
-- Yorgos<br>
<br>
On 05/05/2025 12:35, sir izake via Unbound-users wrote:<br>
> Dear All,<br>
> <br>
> I have Unbound 1.20 DNS recursive? resolver. I intend to enable ECS to <br>
> improve geo-location response to CDN resources.<br>
> <br>
> Unfortunately,? i got below error after i enabled subnetcache in modules<br>
> <br>
> module-config: "respip validator subnetcache iterator"<br>
> <br>
> fatal error: module_conf lists module 'subnetcache' but that module is <br>
> not available<br>
> <br>
> How do I get this to work?<br>
> <br>
> If anyone has successfully set this up in their environment, how did you <br>
> minimize exposure to users IP info. Did you observe any performance <br>
> related issues?<br>
> <br>
> Warm?regards<br>
> Isaac<br>
> <br>
<br>
<br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
Unbound-users mailing list<br>
<a href="mailto:Unbound-users@lists.nlnetlabs.nl" target="_blank">Unbound-users@lists.nlnetlabs.nl</a><br>
<a href="https://lists.nlnetlabs.nl/mailman/listinfo/unbound-users" rel="noreferrer" target="_blank">https://lists.nlnetlabs.nl/mailman/listinfo/unbound-users</a><br>
<br>
<br>
------------------------------<br>
<br>
End of Unbound-users Digest, Vol 65, Issue 2<br>
********************************************<br>
</blockquote></div>