<html aria-label="message body"><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><span style="background-color: rgb(255, 255, 255);">Hi Yorgos,</span><div><br></div><div>actually I observe the error mainly with various .<a href="http://cdn.cloudflare.net/">cdn.cloudflare.net</a>-domains. It seems that the behavior is specific to the cachedb module and only occurs when the cached answer's TTL has expired while the NSEC records remain cached. The synthesized NODATA/NXDOMAIN response is issued directly from the cachedb module, without the iterator-module and no RA flag is added to the response.</div><div>Manually I have trouble reproducing the issue with dig, but it is observed continuously with my dnsmasq instance.</div><div><br></div><div>Unbound version: 1.24.2</div><div>My module-config: validator cachedb iterator</div><div><br></div><div>In the logs below, you can observe two distinct unbound instances (127.0.0.1 and 192.168.1.160). One instance was patched (127.0.0.1) and the dnsmasq warning no longer pops up:</div><div><br></div><div><div>--- a/cachedb/cachedb.c</div><div>+++ b/cachedb/cachedb.c</div><div>@@ -724,6 +724,13 @@</div><div> <span class="Apple-tab-span" style="white-space: pre;"> </span>}</div><div> <span class="Apple-tab-span" style="white-space: pre;"> </span>if(!msg)</div><div> <span class="Apple-tab-span" style="white-space: pre;"> </span>return 0;</div><div>+<span class="Apple-tab-span" style="white-space: pre;"> </span>/* fixup flags to be sensible for a reply based on the cache.</div><div>+<span class="Apple-tab-span" style="white-space: pre;"> </span> * This module means that RA is available. It is an answer QR.</div><div>+<span class="Apple-tab-span" style="white-space: pre;"> </span> * Not AA from cache. Not CD in cache (depends on client bit).</div><div>+<span class="Apple-tab-span" style="white-space: pre;"> </span> * This is needed because val_neg_getmsg() synthesizes messages</div><div>+<span class="Apple-tab-span" style="white-space: pre;"> </span> * with dns_msg_create() which only sets BIT_QR, missing BIT_RA. */</div><div>+<span class="Apple-tab-span" style="white-space: pre;"> </span>msg->rep->flags |= (BIT_RA | BIT_QR);</div><div>+<span class="Apple-tab-span" style="white-space: pre;"> </span>msg->rep->flags &= ~(BIT_AA | BIT_CD);</div><div> <span class="Apple-tab-span" style="white-space: pre;"> </span>/* this is the returned msg */</div><div> <span class="Apple-tab-span" style="white-space: pre;"> </span>qstate->return_rcode = LDNS_RCODE_NOERROR;</div><div> <span class="Apple-tab-span" style="white-space: pre;"> </span>qstate->return_msg = msg;</div></div><div><br></div><div>'rpz-signal-nxdomain-ra: yes’ is not set on my end - afaik it defaults to no.</div><div><br></div><div>Here are some dnsmasq logs that show the “issue” from dnsmasq’s perspective:</div><div><br></div><div><div>Feb 15 00:29:21 dnsmasq[1084]: query[A] <span dir="ltr">connect.garmin.com</span> from 192.168.1.188</div><div>Feb 15 00:29:21 dnsmasq[1084]: forwarded <span dir="ltr">connect.garmin.com</span> to 127.0.0.1#2053</div><div>Feb 15 00:29:21 dnsmasq[1084]: reply <span dir="ltr">connect.garmin.com</span> is <CNAME></div><div>Feb 15 00:29:21 dnsmasq[1084]: reply connect.garmin.com.cdn.cloudflare.net is NODATA</div><div>Feb 15 00:29:21 dnsmasq[1084]: reply <span dir="ltr">connect.garmin.com</span> is <CNAME></div><div>Feb 15 00:29:21 dnsmasq[1084]: reply connect.garmin.com.cdn.cloudflare.net is 104.17.167.14</div><div>Feb 15 00:29:21 dnsmasq[1084]: reply connect.garmin.com.cdn.cloudflare.net is 104.17.168.14</div><div>Feb 15 00:29:22 dnsmasq[1084]: query[HTTPS] connect.garmin.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 15 00:29:22 dnsmasq[1084]: forwarded connect.garmin.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 00:29:22 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 02:39:32 dnsmasq[1084]: query[A] <span dir="ltr">api.gcs.garmin.com</span> from 192.168.1.188</div><div>Feb 15 02:39:32 dnsmasq[1084]: forwarded <span dir="ltr">api.gcs.garmin.com</span> to 127.0.0.1#2053</div><div>Feb 15 02:39:33 dnsmasq[1084]: reply <span dir="ltr">api.gcs.garmin.com</span> is <CNAME></div><div>Feb 15 02:39:33 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is 104.16.9.45</div><div>Feb 15 02:39:33 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is 104.16.8.45</div><div>Feb 15 02:39:33 dnsmasq[1084]: reply <span dir="ltr">api.gcs.garmin.com</span> is <CNAME></div><div>Feb 15 02:39:33 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is NODATA</div><div>Feb 15 02:39:33 dnsmasq[1084]: query[HTTPS] api.gcs.garmin.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 15 02:39:33 dnsmasq[1084]: forwarded api.gcs.garmin.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 02:39:33 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 05:50:39 dnsmasq[1084]: reply connectapi.garmin.com.cdn.cloudflare.net is 104.17.150.222</div><div>Feb 15 05:50:39 dnsmasq[1084]: reply connectapi.garmin.com.cdn.cloudflare.net is 104.17.151.222</div><div>Feb 15 05:50:39 dnsmasq[1084]: reply connectapi.garmin.com.cdn.cloudflare.net is 104.17.152.222</div><div>Feb 15 05:50:39 dnsmasq[1084]: reply connectapi.garmin.com.cdn.cloudflare.net is 104.17.154.222</div><div>Feb 15 05:50:39 dnsmasq[1084]: reply connectapi.garmin.com.cdn.cloudflare.net is 104.17.153.222</div><div>Feb 15 05:50:39 dnsmasq[1084]: reply <span dir="ltr">connectapi.garmin.com</span> is <CNAME></div><div>Feb 15 05:50:39 dnsmasq[1084]: reply connectapi.garmin.com.cdn.cloudflare.net is NODATA</div><div>Feb 15 05:50:39 dnsmasq[1084]: query[HTTPS] connectapi.garmin.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 15 05:50:39 dnsmasq[1084]: forwarded connectapi.garmin.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 05:50:39 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 05:58:39 dnsmasq[1084]: query[A] <span dir="ltr">api.gcs.garmin.com</span> from 192.168.1.188</div><div>Feb 15 05:58:39 dnsmasq[1084]: forwarded <span dir="ltr">api.gcs.garmin.com</span> to 127.0.0.1#2053</div><div>Feb 15 05:58:39 dnsmasq[1084]: reply <span dir="ltr">api.gcs.garmin.com</span> is <CNAME></div><div>Feb 15 05:58:39 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is NODATA</div><div>Feb 15 05:58:39 dnsmasq[1084]: reply <span dir="ltr">api.gcs.garmin.com</span> is <CNAME></div><div>Feb 15 05:58:39 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is 104.16.8.45</div><div>Feb 15 05:58:39 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is 104.16.9.45</div><div>Feb 15 05:58:39 dnsmasq[1084]: query[HTTPS] api.gcs.garmin.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 15 05:58:39 dnsmasq[1084]: forwarded api.gcs.garmin.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 05:58:39 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 06:06:52 dnsmasq[1084]: query[HTTPS] <span dir="ltr">api.gcs.garmin.com</span> from 192.168.1.188</div><div>Feb 15 06:06:52 dnsmasq[1084]: forwarded <span dir="ltr">api.gcs.garmin.com</span> to 127.0.0.1#2053</div><div>Feb 15 06:06:52 dnsmasq[1084]: query[A] <span dir="ltr">api.gcs.garmin.com</span> from 192.168.1.188</div><div>Feb 15 06:06:52 dnsmasq[1084]: forwarded <span dir="ltr">api.gcs.garmin.com</span> to 127.0.0.1#2053</div><div>Feb 15 06:06:52 dnsmasq[1084]: reply <span dir="ltr">api.gcs.garmin.com</span> is <CNAME></div><div>Feb 15 06:06:52 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is NODATA</div><div>Feb 15 06:06:52 dnsmasq[1084]: query[HTTPS] api.gcs.garmin.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 15 06:06:52 dnsmasq[1084]: forwarded api.gcs.garmin.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 06:06:52 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 06:14:24 dnsmasq[1084]: reply <span dir="ltr">api.gcs.garmin.com</span> is <CNAME></div><div>Feb 15 06:14:24 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is 104.16.8.45</div><div>Feb 15 06:14:24 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is 104.16.9.45</div><div>Feb 15 06:14:24 dnsmasq[1084]: reply <span dir="ltr">api.gcs.garmin.com</span> is <CNAME></div><div>Feb 15 06:14:24 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is NODATA</div><div>Feb 15 06:14:24 dnsmasq[1084]: query[HTTPS] api.gcs.garmin.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 15 06:14:24 dnsmasq[1084]: forwarded api.gcs.garmin.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 06:14:24 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 07:15:01 dnsmasq[1084]: query[A] <span dir="ltr">api.gcs.garmin.com</span> from 192.168.1.188</div><div>Feb 15 07:15:01 dnsmasq[1084]: forwarded <span dir="ltr">api.gcs.garmin.com</span> to 127.0.0.1#2053</div><div>Feb 15 07:15:01 dnsmasq[1084]: reply <span dir="ltr">omt.garmin.com</span> is <CNAME></div><div>Feb 15 07:15:01 dnsmasq[1084]: reply omt.garmin.com.cdn.cloudflare.net is NODATA</div><div>Feb 15 07:15:01 dnsmasq[1084]: reply <span dir="ltr">omt.garmin.com</span> is <CNAME></div><div>Feb 15 07:15:01 dnsmasq[1084]: reply omt.garmin.com.cdn.cloudflare.net is 104.17.71.10</div><div>Feb 15 07:15:01 dnsmasq[1084]: reply omt.garmin.com.cdn.cloudflare.net is 104.17.70.10</div><div>Feb 15 07:15:01 dnsmasq[1084]: query[HTTPS] omt.garmin.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 15 07:15:01 dnsmasq[1084]: forwarded omt.garmin.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 07:15:01 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 07:15:05 dnsmasq[1084]: query[HTTPS] connectapi.garmin.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 15 07:15:05 dnsmasq[1084]: forwarded connectapi.garmin.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 07:15:05 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 07:22:55 dnsmasq[1084]: reply <span dir="ltr">connectapi.garmin.com</span> is <CNAME></div><div>Feb 15 07:22:55 dnsmasq[1084]: reply connectapi.garmin.com.cdn.cloudflare.net is NODATA</div><div>Feb 15 07:22:55 dnsmasq[1084]: reply <span dir="ltr">api.gcs.garmin.com</span> is <CNAME></div><div>Feb 15 07:22:55 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is 104.16.9.45</div><div>Feb 15 07:22:55 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is 104.16.8.45</div><div>Feb 15 07:22:55 dnsmasq[1084]: reply <span dir="ltr">api.gcs.garmin.com</span> is <CNAME></div><div>Feb 15 07:22:55 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is NODATA</div><div>Feb 15 07:22:55 dnsmasq[1084]: query[HTTPS] api.gcs.garmin.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 15 07:22:55 dnsmasq[1084]: forwarded api.gcs.garmin.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 07:22:55 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 08:24:45 dnsmasq[1084]: reply omt.garmin.com.cdn.cloudflare.net is 104.17.70.10</div><div>Feb 15 08:24:45 dnsmasq[1084]: query[HTTPS] <span dir="ltr">connectapi.garmin.com</span> from 192.168.1.188</div><div>Feb 15 08:24:45 dnsmasq[1084]: forwarded <span dir="ltr">connectapi.garmin.com</span> to 127.0.0.1#2053</div><div>Feb 15 08:24:45 dnsmasq[1084]: query[A] <span dir="ltr">connectapi.garmin.com</span> from 192.168.1.188</div><div>Feb 15 08:24:45 dnsmasq[1084]: forwarded <span dir="ltr">connectapi.garmin.com</span> to 127.0.0.1#2053</div><div>Feb 15 08:24:45 dnsmasq[1084]: reply <span dir="ltr">connectapi.garmin.com</span> is <CNAME></div><div>Feb 15 08:24:45 dnsmasq[1084]: reply connectapi.garmin.com.cdn.cloudflare.net is NODATA</div><div>Feb 15 08:24:45 dnsmasq[1084]: query[HTTPS] connectapi.garmin.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 15 08:24:45 dnsmasq[1084]: forwarded connectapi.garmin.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 08:24:45 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 08:54:35 dnsmasq[1084]: reply connectapi.garmin.com.cdn.cloudflare.net is 104.17.154.222</div><div>Feb 15 08:54:35 dnsmasq[1084]: reply connectapi.garmin.com.cdn.cloudflare.net is 104.17.150.222</div><div>Feb 15 08:54:35 dnsmasq[1084]: reply connectapi.garmin.com.cdn.cloudflare.net is 104.17.151.222</div><div>Feb 15 08:54:35 dnsmasq[1084]: reply connectapi.garmin.com.cdn.cloudflare.net is 104.17.152.222</div><div>Feb 15 08:54:35 dnsmasq[1084]: reply connectapi.garmin.com.cdn.cloudflare.net is 104.17.153.222</div><div>Feb 15 08:54:35 dnsmasq[1084]: reply <span dir="ltr">connectapi.garmin.com</span> is <CNAME></div><div>Feb 15 08:54:35 dnsmasq[1084]: reply connectapi.garmin.com.cdn.cloudflare.net is NODATA</div><div>Feb 15 08:54:35 dnsmasq[1084]: query[HTTPS] connectapi.garmin.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 15 08:54:35 dnsmasq[1084]: forwarded connectapi.garmin.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 08:54:35 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 10:09:38 dnsmasq[1084]: reply <span dir="ltr">cache.dciwx.com</span> is <CNAME></div><div>Feb 15 10:09:38 dnsmasq[1084]: reply cache.dciwx.com.cdn.cloudflare.net is NODATA</div><div>Feb 15 10:09:38 dnsmasq[1084]: reply <span dir="ltr">cache.dciwx.com</span> is <CNAME></div><div>Feb 15 10:09:38 dnsmasq[1084]: reply cache.dciwx.com.cdn.cloudflare.net is 104.19.151.56</div><div>Feb 15 10:09:38 dnsmasq[1084]: reply cache.dciwx.com.cdn.cloudflare.net is 104.19.152.56</div><div>Feb 15 10:09:38 dnsmasq[1084]: query[HTTPS] cache.dciwx.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 15 10:09:38 dnsmasq[1084]: forwarded cache.dciwx.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 10:09:38 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 11:54:58 dnsmasq[1084]: reply <span dir="ltr">connect.garmin.com</span> is <CNAME></div><div>Feb 15 11:54:58 dnsmasq[1084]: reply connect.garmin.com.cdn.cloudflare.net is 104.17.167.14</div><div>Feb 15 11:54:58 dnsmasq[1084]: reply connect.garmin.com.cdn.cloudflare.net is 104.17.168.14</div><div>Feb 15 11:54:58 dnsmasq[1084]: reply <span dir="ltr">connect.garmin.com</span> is <CNAME></div><div>Feb 15 11:54:58 dnsmasq[1084]: reply connect.garmin.com.cdn.cloudflare.net is NODATA</div><div>Feb 15 11:54:58 dnsmasq[1084]: query[HTTPS] connect.garmin.com.cdn.cloudflare.net from 192.168.1.218</div><div>Feb 15 11:54:58 dnsmasq[1084]: forwarded connect.garmin.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 11:54:58 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 11:59:18 dnsmasq[1084]: reply <span dir="ltr">api.gcs.garmin.com</span> is <CNAME></div><div>Feb 15 11:59:18 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is 104.16.8.45</div><div>Feb 15 11:59:18 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is 104.16.9.45</div><div>Feb 15 11:59:18 dnsmasq[1084]: reply <span dir="ltr">api.gcs.garmin.com</span> is <CNAME></div><div>Feb 15 11:59:18 dnsmasq[1084]: reply api.gcs.garmin.com.cdn.cloudflare.net is NODATA</div><div>Feb 15 11:59:18 dnsmasq[1084]: query[HTTPS] api.gcs.garmin.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 15 11:59:18 dnsmasq[1084]: forwarded api.gcs.garmin.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 11:59:18 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 12:09:39 dnsmasq[1084]: reply <span dir="ltr">cache.dciwx.com</span> is <CNAME></div><div>Feb 15 12:09:39 dnsmasq[1084]: reply cache.dciwx.com.cdn.cloudflare.net is 104.19.152.56</div><div>Feb 15 12:09:39 dnsmasq[1084]: reply cache.dciwx.com.cdn.cloudflare.net is 104.19.151.56</div><div>Feb 15 12:09:39 dnsmasq[1084]: reply <span dir="ltr">cache.dciwx.com</span> is <CNAME></div><div>Feb 15 12:09:39 dnsmasq[1084]: reply cache.dciwx.com.cdn.cloudflare.net is NODATA</div><div>Feb 15 12:09:39 dnsmasq[1084]: query[HTTPS] cache.dciwx.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 15 12:09:39 dnsmasq[1084]: forwarded cache.dciwx.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 12:09:39 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 12:21:09 dnsmasq[1084]: query[HTTPS] omt.garmin.com.cdn.cloudflare.net from 192.168.1.218</div><div>Feb 15 12:21:09 dnsmasq[1084]: forwarded omt.garmin.com.cdn.cloudflare.net to 127.0.0.1#2053</div><div>Feb 15 12:21:09 dnsmasq[1084]: nameserver 127.0.0.1 refused to do a recursive query</div><div>--</div><div>Feb 15 22:57:45 dnsmasq[1084]: query[HTTPS] omt.garmin.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 15 22:57:45 dnsmasq[1084]: forwarded omt.garmin.com.cdn.cloudflare.net to 192.168.1.160#5053</div><div>Feb 15 22:57:45 dnsmasq[1084]: nameserver 192.168.1.160 refused to do a recursive query</div></div><div>--</div><div><div>Feb 16 06:54:02 dnsmasq[1084]: query[HTTPS] static.licdn.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 16 06:54:02 dnsmasq[1084]: forwarded static.licdn.com.cdn.cloudflare.net to 192.168.1.160#5053</div><div>Feb 16 06:54:02 dnsmasq[1084]: nameserver 192.168.1.160 refused to do a recursive query</div><div>--</div><div>Feb 16 08:39:39 dnsmasq[1084]: reply <span dir="ltr">cache.dciwx.com</span> is <CNAME></div><div>Feb 16 08:39:39 dnsmasq[1084]: reply cache.dciwx.com.cdn.cloudflare.net is NODATA</div><div>Feb 16 08:39:39 dnsmasq[1084]: query[HTTPS] cache.dciwx.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 16 08:39:39 dnsmasq[1084]: forwarded cache.dciwx.com.cdn.cloudflare.net to 192.168.1.160#5053</div><div>Feb 16 08:39:39 dnsmasq[1084]: nameserver 192.168.1.160 refused to do a recursive query</div><div>--</div><div>Feb 16 09:39:38 dnsmasq[1084]: query[HTTPS] <span dir="ltr">cache.dciwx.com</span> from 192.168.1.188</div><div>Feb 16 09:39:38 dnsmasq[1084]: forwarded <span dir="ltr">cache.dciwx.com</span> to 192.168.1.160#5053</div><div>Feb 16 09:39:38 dnsmasq[1084]: query[A] <span dir="ltr">cache.dciwx.com</span> from 192.168.1.188</div><div>Feb 16 09:39:38 dnsmasq[1084]: forwarded <span dir="ltr">cache.dciwx.com</span> to 192.168.1.160#5053</div><div>Feb 16 09:39:39 dnsmasq[1084]: reply <span dir="ltr">cache.dciwx.com</span> is <CNAME></div><div>Feb 16 09:39:39 dnsmasq[1084]: reply cache.dciwx.com.cdn.cloudflare.net is NODATA</div><div>Feb 16 09:39:39 dnsmasq[1084]: query[HTTPS] cache.dciwx.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 16 09:39:39 dnsmasq[1084]: forwarded cache.dciwx.com.cdn.cloudflare.net to 192.168.1.160#5053</div><div>Feb 16 09:39:39 dnsmasq[1084]: nameserver 192.168.1.160 refused to do a recursive query</div><div>--</div><div>Feb 16 10:39:39 dnsmasq[1084]: query[A] <span dir="ltr">cache.dciwx.com</span> from 192.168.1.188</div><div>Feb 16 10:39:39 dnsmasq[1084]: forwarded <span dir="ltr">cache.dciwx.com</span> to 192.168.1.160#5053</div><div>Feb 16 10:39:39 dnsmasq[1084]: reply <span dir="ltr">cache.dciwx.com</span> is <CNAME></div><div>Feb 16 10:39:39 dnsmasq[1084]: reply cache.dciwx.com.cdn.cloudflare.net is NODATA</div><div>Feb 16 10:39:39 dnsmasq[1084]: reply <span dir="ltr">cache.dciwx.com</span> is <CNAME></div><div>Feb 16 10:39:39 dnsmasq[1084]: reply cache.dciwx.com.cdn.cloudflare.net is 104.19.151.56</div><div>Feb 16 10:39:39 dnsmasq[1084]: reply cache.dciwx.com.cdn.cloudflare.net is 104.19.152.56</div><div>Feb 16 10:39:39 dnsmasq[1084]: query[HTTPS] cache.dciwx.com.cdn.cloudflare.net from 192.168.1.188</div><div>Feb 16 10:39:39 dnsmasq[1084]: forwarded cache.dciwx.com.cdn.cloudflare.net to 192.168.1.160#5053</div><div>Feb 16 10:39:39 dnsmasq[1084]: nameserver 192.168.1.160 refused to do a recursive query</div></div><div><br></div><div><div>Best regards,</div><div>Jürgen</div></div><div><br><blockquote type="cite"><div>On 16.02.2026, at 14:01, Yorgos Thessalonikefs via Unbound-users <unbound-users@lists.nlnetlabs.nl> wrote:</div><br class="Apple-interchange-newline"><div><div>Hi Jürgen,<br><br>Do you have a concrete case we can look at?<br>Testcases in Unbound do return the RA flag when 'aggressive-nsec: yes' is used (by default).<br><br>Maybe you are using RPZ data and you have set<br>'rpz-signal-nxdomain-ra: yes' [1] ?<br>Btw yhis option was explicitly requested to play nice with dnsmasq IIRC.<br><br>Best regards,<br>-- Yorgos<br><br>[1] https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#unbound-conf-rpz-rpz-signal-nxdomain-ra<br><br>On 16/02/2026 11:12, Jürgen Stauber via Unbound-users wrote:<br><blockquote type="cite">Hello together,<br>I’m running unbound as my recursive resolver and encountered various "dnsmasq: nameserver 127.0.0.1 refused to do a recursive query” error messages. After some debugging with the help of an LLM it seems that the RA flag is missing when receiving synthesized NODATA or NXDOMAIN responses from the NSEC negative cache. Now I’m not sure if this is a bug and an issue should be opened or if this intended behavior. Do you need further info to make an assessment? If so, what kind of input would help?<br>Thanks and kind regards<br>Jürgen<br></blockquote><br></div></div></blockquote></div><br></body></html>