Unbound notice: sendto failed: Permission denied

  • I'm running 2.4.2-RELEASE-p1 (amd64)
    I get ton of messages below in my resolver log if I enable Register DHCP leases in the DNS Resolver and Register DHCP static mappings in the DNS Resolver.

    Jan 12 10:22:34 unbound 63108:3 notice: remote address is xxx.xx.xx.xx port 53
    Jan 12 10:22:52 unbound 63108:3 notice: sendto failed: Permission denied

    Name resolution seems to be working fine, although I could swear it's a bit slower now. I'm sure this is nothing to worry about, but I would like to understand what it's about. Also, having these constantly in the log hide actual events I would like to see. Should I just lower the verbosity? Would that make any difference?

    EDIT: I cleared my proxy cache because I was getting a cache related error from squid for a specific site. After that, name resolution completely failed. I unchecked both Register DHCP and static options until that proves to be stable. I had to reboot pfsense because resolver didn't seem to even respond to an attempt at stopping the service, so restarting resolver alone was not an option.


  • I have same log entries in logs, but all seems works fine, I can't say clearly about performance because I have Windows DNS that actually give DNS to client and take it from pfSense and have many cache entries.

  • I have the same issue running 2.4.3-RELEASE-p1

    Aug 3 09:17:39 unbound 31135:3 notice: remote address is XXX.XXX.XXX.XXX port 53
    Aug 3 09:17:39 unbound 31135:3 notice: sendto failed: Permission denied

    The IPs in the errors are,, and

    When these errors are shown in the unbound log, my network (which is only pointing to pfsense's IP as DNS) cannot longer resolve google.com (although it can resolve other domain names).

    Only a reboot fixes the issue so far.

  • LAYER 8 Netgate

    Running snort or suricata? Is it blocking those addresses for some reason?

  • @derelict good point, will check logs next time this happens. I am running Snort.

  • I have that same problem today.

    "notice: sendto failed: Permission denied". Suricata is blocking these adresses because of "ET DNS Query to a *.pw domain - Likely Hostile". But why? What happened?

  • LAYER 8 Netgate

    You'll have to see what suricata complained about and make it not do that. It's likely only doing what it was told to do.

Log in to reply