Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS Resolver / DNSSEC in permissive mode.

    Scheduled Pinned Locked Moved DHCP and DNS
    19 Posts 5 Posters 4.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D Offline
      doktornotor Banned
      last edited by

      Once again, there is absolutely NOTHING described about "permissive mode" anywhere on the test page you used. Repeated this for about 4 times already, gets annoying. I've provided multitude of other ways to check your DNSSEC, kindly use them. Or use dig or whatever similar to test your DNSSEC manually - https://wiki.debian.org/DNSSEC#Command_line

      1 Reply Last reply Reply Quote 0
      • T Offline
        tuffcalc
        last edited by

        See attached…

        The words "PERMISSIVE MODE" look pretty clear to me.

        Capture.PNG
        Capture.PNG_thumb

        1 Reply Last reply Reply Quote 0
        • D Offline
          doktornotor Banned
          last edited by

          Hell. They have this fscking FAQ there. It says nothing about permissive. I am unable to get any such result there. I can get either pass or fail. Nothing "permissive". Now, either use the other ways to validate, or just have fun discussing this for a couple more days… Enough time wasted. I don't care about that site. Clear enough already?

          The unbound configuratios is at /var/unbound/unbound.conf, you can check for your "permissive". Never been an option to be ticked in the GUI on 2.2.x

          1 Reply Last reply Reply Quote 0
          • T Offline
            tuffcalc
            last edited by

            @doktornotor:

            Hell. They have this fscking FAQ there. It says nothing about permissive. I am unable to get any such result there. I can get either pass or fail. Nothing "permissive". Now, either use the other ways to validate, or just have fun discussing this for a couple more days… Enough time wasted. I don't care about that site. Clear enough already?

            The unbound configuratios is at /var/unbound/unbound.conf, you can check for your "permissive". Never been an option to be ticked in the GUI on 2.2.x

            Thanks … will check the unbound.conf file.

            As for the rest of your message... get a life buddy.

            1 Reply Last reply Reply Quote 0
            • KOMK Offline
              KOM
              last edited by

              From unbound.net:

              1. Permissive mode

              Does not actually turn off dnssec, but stops the resolver from withholding bogus answers from clients. Resolution may be slow due to validation failures but can still proceed. Add to the unbound.conf file:

              server:        val-permissive-mode: yes

              So, permissive mode allows the server to return a response even if DNSSEC fails, but the response could be bogus which defeats the entire point of DNSSEC.

              1 Reply Last reply Reply Quote 0
              • D Offline
                doktornotor Banned
                last edited by

                Yep. Already linked above. Never been a GUI option on pfSense. Of course, when you tick DNSSEC in Unbound and instead of using it properly as a recursive resolver your forward the DNS to crap like OpenDNS (which does not support DNSSEC at all), then all you get is broken DNSSEC.

                1 Reply Last reply Reply Quote 0
                • KOMK Offline
                  KOM
                  last edited by

                  Yep. Already linked above.

                  I was just making it clearer for those who would rather not go link-following down rabbit holes.  Why link externally when a single sentence says everything you need to know?

                  1 Reply Last reply Reply Quote 0
                  • G Offline
                    gjaltemba
                    last edited by

                    test 1) Using pfSense unbound with dnssec checked, site will report green check you are protected

                    test 2) Using pfSense unbound with dnssec unchecked, site will report red cross you are not protected

                    test 3) Using pfSense unbound with dnssec checked, site will report red cross you are not protected. Permissive mode detected:
                    Your DNSSEC is configured in "permissive mode" (or you use a combination of validating- and non-validating resolvers) and as such you are not protected.

                    At this point I tried restarting unbound. flushdns, another browser all yielded Permissive mode detected: After a few hours site will report green check you are protected. sheesh

                    http://dnssectest.sidnlabs.nl/test.php

                    1 Reply Last reply Reply Quote 0
                    • D Offline
                      doktornotor Banned
                      last edited by

                      I would suggest testing elsewhere. I already did about 5 times, but apparently everyone insists on using the broken one.

                      1 Reply Last reply Reply Quote 0
                      • G Offline
                        gjaltemba
                        last edited by

                        btw. I get two thumbs up from Borat.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.