Troubleshooting DNS Resolution Issues in My Homelab with Unbound and dnsmasq

Introduction to DNS Resolution Issues

I’ve had my fair share of DNS resolution issues in my homelab over the years. Recently, I switched from using a single DNS resolver to a combination of Unbound and dnsmasq. This setup has been working well for me, but I’ve still encountered some issues that required troubleshooting. The real trick is identifying the root cause of the problem, which can be tricky.

Understanding Unbound and dnsmasq

Unbound is a recursive DNS resolver that provides a secure and private way to resolve domain names. It’s designed to be fast, efficient, and highly configurable. Dnsmasq, on the other hand, is a lightweight DNS forwarder and DHCP server. I’ve seen this go wrong when people don’t configure them correctly, so it’s essential to understand how they work together. In practice, using Unbound and dnsmasq together provides a good balance between security and performance.

To configure Unbound and dnsmasq, I used the following commands:

# Install Unbound and dnsmasq
sudo apt-get install unbound dnsmasq

# Configure Unbound to listen on localhost
sudo nano /etc/unbound/unbound.conf

In the unbound.conf file, I added the following lines:

server:
    interface: 127.0.0.1
    port: 5335
    do-ip4: yes
    do-ip6: yes
    do-udp: yes
    do-tcp: yes

Don’t bother with the default configuration files - it’s better to start with a clean slate.

Configuring dnsmasq

To configure dnsmasq, I created a new file called dnsmasq.conf in the /etc/dnsmasq.d/ directory:

sudo nano /etc/dnsmasq.d/dnsmasq.conf

In this file, I added the following lines:

# Use Unbound as the upstream DNS server
server=127.0.0.1#5335

# Listen on localhost
listen-address=127.0.0.1

This is where people usually get burned - not configuring dnsmasq to use Unbound as the upstream DNS server.

Troubleshooting DNS Resolution Issues

When I encountered DNS resolution issues, I used the following commands to troubleshoot:

# Check the Unbound logs
sudo journalctl -u unbound

# Check the dnsmasq logs
sudo journalctl -u dnsmasq

# Use dig to test DNS resolution
dig example.com @127.0.0.1 -p 5335

I usually start with the logs to see if there are any obvious issues. If not, I use dig to test DNS resolution.

Security Considerations

When configuring Unbound and dnsmasq, security is a top priority. One potential issue is DNS amplification attacks, which can be mitigated by configuring Unbound to only listen on localhost. In practice, this is a simple but effective way to prevent these types of attacks. Additionally, I made sure to keep my DNS software up to date to prevent any known vulnerabilities. For more information on securing Unbound, I recommend checking out the Unbound documentation on the NLnet Labs website.

Next Steps

If you’re interested in learning more about DNS security, I recommend checking out the DNSSEC documentation on the Internet Society website. With a solid understanding of Unbound and dnsmasq, you’ll be well on your way to securing your homelab’s DNS.