questions and configuration

[maxmonz69]

Hello,
In my home lab I use two raspberries with pi-hole as DNS server and I recently installed unbound (recursive) as docker container on both raspberries.
I had a lot of problems with a few sites and app (android or smart TV or sky decoder).
For example there are site urls that sometimes can not be resolved making impossible to visit their pages but sometimes they works.
Another example: PrimeVIdeo doesn't work from Sky or LG TV app while it works on a Samsung TV.
The Sonos app on my phone can't play my music stored in a local Plex server. I see the list of files but I can't play them.
By the way, i had to add some exceptions in unbound.conf.
All these problems appeared after I switched to unbound as resolver.

My questions are: am I too ambitious? Should I try unbound in forward mode? (but does i make sense?). Could the docker layer introduce some delay or problem responsible of such failures?

This is my unbound.conf

server:
# Livello di log (1 = solo errori e query principali)
verbosity: 1

logfile: "/etc/unbound/unbound.log"

use-syslog: no
log-time-ascii: yes
log-queries: yes

interface: 0.0.0.0
port: 53

root-hints: "/etc/unbound/root.hints"

auto-trust-anchor-file: "/etc/unbound/root.key"


do-ip4: yes
do-udp: yes
do-tcp: yes
do-ip6: no

access-control: 127.0.0.0/8 allow
access-control: 192.168.0.0/16 allow
access-control: 172.16.0.0/12 allow

private-address: 127.0.0.0/8
private-address: 192.168.0.0/16
private-address: 172.16.0.0/12

hide-identity: yes
hide-version: yes
use-caps-for-id: no
harden-glue: yes
harden-dnssec-stripped: yes

private-domain: "local"
private-domain: "home.arpa"
domain-insecure: "local"
domain-insecure: "home.arpa"
    
private-domain: <myprivatedomain>
domain-insecure: <myprivatedomain>

domain-insecure: "amazon.com"
domain-insecure: "primevideo.com"
domain-insecure: "media-amazon.com"
domain-insecure: "aiv-cdn.net"    
local-zone: "amazon.com." transparent
local-zone: "primevideo.com." transparent
local-zone: "media-amazon.com." transparent

edns-buffer-size: 1232
prefetch: yes
num-threads: 1
so-rcvbuf: 1m
so-sndbuf: 0

msg-cache-slabs: 4
rrset-cache-slabs: 4
infra-cache-slabs: 4
key-cache-slabs: 4
rrset-cache-size: 100m
msg-cache-size: 50m

send-client-subnet: yes
client-subnet-always-forward: no        

local-zone: "168.192.in-addr.arpa." transparent

fast-server-permil: 900
infra-cache-numhosts: 10000    

private-domain: "sonos.com"
private-domain: "sonos-pstore.com"
private-domain: "ws.sonos.com"
private-domain: "urbanairship.com"
private-domain: "optimizely.com"
private-domain: "sonos-smapi.io"
private-domain: "msv.sonos.com"
private-domain: "audio-ak-spotify-com.akamaized.net"
domain-insecure: "sonos.com"
domain-insecure: "sonos-pstore.com"
domain-insecure: "ws.sonos.com"
domain-insecure: "urbanairship.com"
domain-insecure: "optimizely.com"
domain-insecure: "sonos-smapi.io"
domain-insecure: "msv.sonos.com"
domain-insecure: "audio-ak-spotify-com.akamaized.net"
local-zone: "sonos.com." transparent
local-zone: "sonos-pstore.com." transparent
local-zone: "ws.sonos.com." transparent
local-zone: "urbanairship.com." transparent
local-zone: "optimizely.com." transparent
local-zone: "sonos-smapi.io." transparent
local-zone: "msv.sonos.com." transparent
local-zone: "audio-ak-spotify-com.akamaized.net." transparent

remote-control:
control-enable: yes
control-interface: 127.0.0.1
control-use-cert: no

forward-zone:
name:
forward-addr: 1.1.1.1
forward-addr: 1.0.0.1

[wcawijngaards]

Using edns-subnet is probably not useful. Sending the home network 192.168.x.x address to a server on the internet does not enable it to use a better data center, or so. So I would disable those options. The private-address options are conflicting with all those home appliances, they are using a troublesome way to access their devices, since using local addresses from global domain names, it not making a good security point. But anyway, there are then also domain-insecure items for them.

If you are looking for more talk about using the server, there is a community discussion forum. It can be found on the project page link to it. Other than that I see nothing actually wrong with this config.