Setting up DNS *correctly*

bwalkco

My apologies, but it has been so long since I've had to set this up and I feel like I'm running in circles or potentially not accomplishing my goals. I'm hoping to find an "ELI5" whitepaper on how to setup my DNS correctly. I'm having difficulty wrapping my brain around DNS Resolver vs DNS Forwarder and I think I've left myself exposed.

Current state -->

DNS Servers: 127.0.0.1 / 1.1.1.1 / 1.0.0.1
DNS Forwarder: Not Enabled
DNS Resolver: Enabled, Incoming / Outgoing Interfaces - All, Enable DNSSEC checked, SSL/TLS enabled, Register DHCP leases in the DNS Resolver unchecked

My goals -->

I'd like for my SG3100 to handle all DNS queries, forward requests securely to 1.1.1.1 / 1.0.0.1 when it cannot resolve, and essentially mask my DNS from my ISP (Comcast). As it stands now, I cannot ping any device in my network by name, which indicates to me that I have this setup incorrectly. Is it as simple as checking the "Register leases in DNS resolver" checkbox and keeping everything as it is now? I'm not sure what I'm missing here and appreciate any guidance that can be provided. If there is more detail needed, let me know and I'll be happy to provide that detail.

In a nutshell, I want to be a secure as possible (wrt DNS) while still maintaining usability.

Edit to add: When I browse to http://www.whatsmydnsserver.com/, it shows my ISP as my DNS server. :(

johnpoz

@bwalkco said in Setting up DNS *correctly*:

orward requests securely to 1.1.1.1 / 1.0.0.1 when it cannot resolve,

Doesn't work that way..

What do you want to do - do you want to resolve, or do you want to forward?

KOM

@bwalkco said in Setting up DNS *correctly*:

it shows my ISP as my DNS server.

Make sure that System - General Setup - DNS Server Settings - DNS Server Override is unchecked, otherwise your ISPs DNS will be forced upon you via DHCP.

bwalkco

@KOM verified it is unchecked. I also noticed that "DNS Query Forwarding" wasn't checked. I enabled that.

johnpoz

if you enabled "forwarding" in unbound then your not "resolving"

bwalkco

@johnpoz sorry, I'm not sure I follow. I'd like for the Netgate to handle all DNS queries it can and forward requests when it can't resolve. If that is not possible, then I'd like to have the Netgate handle all internal DNS and direct all external requests to 1.1.1.1 / 1.0.0.1

johnpoz

@bwalkco said in Setting up DNS *correctly*:

forward requests when it can't resolve.

And again it doesn't work that way!!!!

You either resolve, or you forward... Its not a fall back sort of scenario..

If you want to forward - sure have at it, zero reason to have the checkbox for dnssec then..

KOM

A resolver uses the DNS root hints to find the authoritative server for the queried domain and then query that server. A forwarder just forwards all queries to some other upstream DNS. You need to decide what you want.

bwalkco

@johnpoz Does that also apply to local queries (I assume no)? My other reply to you may add some clarity.

johnpoz

If you ask unbound for something.domain.tld, and there is no host override or locally registered entry for that then it will either forward or resolve it depending on your settings.

With some caveats to how you setup the zone in unbound, transparent, static, etc. and what the domain of the query is for..

bwalkco

@johnpoz Ok, my apologies. Sorry if this is frustrating you. I'm just trying to learn. So it sounds like I cannot resolve internal requests and forward external requests. Thank you.

bwalkco

@KOM said in Setting up DNS *correctly*:

A resolver uses the DNS root hints to find the authoritative server for the queried domain and then query that server. A forwarder just forwards all queries to some other upstream DNS. You need to decide what you want.

Great, thank you! Appreciate it.

johnpoz

Yes you can query unbound for you local records, and forward other domains.. Wouldn't use the term resolving in that sense when talking about unbound.. Which out of the box is a "resolver" and doesn't forward..

bwalkco

@johnpoz said in Setting up DNS *correctly*:

Yes you can query unbound for you local records, and forward other domains.. Wouldn't use the term resolving in that sense when talking about unbound.. Which out of the box is a "resolver" and doesn't forward..

Appreciate the clarity! Thank you. Like I mentioned, it's been a while since I've done this so my nomenclature may be a bit off. After I checked the "Register DHCP leases in DNS resolver", I am able to ping by name locally. That problem is solved. With "DNS Query Forwarding" checked, I am now sending all external (www.example.com) DNS queries to 1.1.1.1 / 1.0.0.1, correct?

If I am understanding you correctly if I want my Netgate to be the authoritative name server for external queries (from any device behind the SG-3100) I just need to disable "DNS Query Forwarding"?

KOM

An authoritative name server is a DNS server that has the ultimate authority over the addresses in a domain. Resolvers talk directly to authoritative servers. Forwarders talk to any specified upstream DNS server.

By default, pfSense has an enabled resolver and disabled forwarder. Resolver can act as a forwarder if you tell it to.

johnpoz

@bwalkco said in Setting up DNS *correctly*:

f I want my Netgate to be the authoritative name server for external queries

What - NO!! For starters unbound not meant to be authoritative for any domain.. Can it ack like one - sure kind of.. If you want to run an authoritative NS for a domain. Run bind..

I think your just throwing out terms you have heard without any understanding of their meaning...

So any NS will return what is in its cache or local data when asked. Depending if its a resolver or forwarder is what happens when it is asked to do recursion..

Normally!!! an authoritative NS will not do recursion... Since normally these are open to the public internet because people want to resolve what they are authoritative for.. And asking them to also do recursion can lead to big issues and ability to answer the queries for what they are authoritative for, etc..

Unbound is not meant to be authoritative for any zone... It will not hand back a SOA record pointing to itself when you ask for something it does have records for, etc. Can it do that - yeah with some tweaking..

What it really is meant to do is be a caching ns, that resolves.. Yes you can put in neat stuff local host overrides - really just shit your perm storing in its cache... And sure you can put in domain overrides that tells it hey don't resolve domainX.tld - ask NS xyz..

bwalkco

@KOM said in Setting up DNS *correctly*:

An authoritative name server is a DNS server that has the ultimate authority over the addresses in a domain. Resolvers talk directly to authoritative servers. Forwarders talk to any specified upstream DNS server.

By default, pfSense has an enabled resolver and disabled forwarder. Resolver can act as a forwarder if you tell it to.

Gotcha, ok! I think some of my old web hosting lingo (from years ago) is being conflated in my head. Appreciate the clarity around that.

bwalkco

@johnpoz said in Setting up DNS *correctly*:

I think your just throwing out terms you have heard without any understanding of their meaning...

Sorry you came to that conclusion...have a great day

KOM

If you want to forward all DNS requests to 1.1.1.1, either:

disable resolver, enable forwarder and put 1.1.1.1 under System - General Setup - DNS Servers.

or

enable resolver, disable forwarder, check DNS Query Forwarding and put 1.1.1.1 under System - General Setup - DNS Servers.

bwalkco

@KOM said in Setting up DNS *correctly*:

enable resolver, disable forwarder, check DNS Query Forwarding and put 1.1.1.1 under System - General Setup - DNS Servers.

This is the exact configuration I went with. Thank you very much for the help!