A Local Resolver That Validates What It Answers

unbound-resolver

A local Unbound resolver: DNSSEC-validating, caching, name-minimising, and answering on loopback only. Original role for EL 9 and 10, live-tested with podman on Rocky Linux 10.

The package ignores its own drop-in directories. EL's unbound.conf ships conf.d/ and local.d/ beside it but no active include: of either - only commented examples - so a file dropped into conf.d changes nothing. This role writes the whole unbound.conf, validated by unbound-checkconf before it is installed, and includes both directories from it so your additions work.

Answers are validated, not just cached. With auto-trust-anchor-file pointing at the root key the package keeps current, a forged or stripped answer is refused rather than served for a day. The verify step asks for example.com with DNSSEC and asserts the ad flag came back.

It says as little as possible. Query-name minimisation sends each upstream only the labels it needs, hide-identity and hide-version refuse version.bind, and minimal-responses keeps additional data out.

Encrypted forwarding is the default; recursion is the switch. Queries go to Quad9 over DNS-over-TLS, with the certificate checked against the system bundle, and every answer is validated locally all the same. Set unbound_resolver_forwarders: [] for full recursion from the root servers - with one thing measured rather than assumed while building this role: on a network that resets TCP 53 to anything but a known resolver (the one this was tested from does), recursion fails outright, because the root DNSKEY answer is larger than the 1232-byte EDNS buffer, is truncated, falls back to TCP, and the TCP connection is reset. "No servers could be reached" is the whole symptom. Over DNS-over-TLS the same answer arrives whole.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.