DNS resolver mode or Forwading mode

JonathanLee

Hello fellow Netgate Community Members,

I wanted to ask if you prefer forwarding mode or resolver mode for unbound?

I have for the first time turned off forwarding mode and its amazing it can talk to the master servers itself.

What does everyone else do here? Do you use forwarding mode or do the DNS resolving yourself?

johnpoz

@JonathanLee have been resolving since unbound was just a package in pfsense, before that believe was using bind package to also resolve.

I have no idea why anyone would ever do anything other than resolving.

JonathanLee

@johnpoz on the 2100 it spikes cpu use but maybe it will calm down after 24 hours first time I tried it, it’s pretty cool to talk to master servers yourself.

SteveITS

@JonathanLee forwarding to Quad9 (or Cloudflare etc.) for a layer of malware protection.

Gertjan

@johnpoz said in DNS resolver mode or Forwading mode:

have been resolving since unbound was just a package in pfsense, before that believe was using bind package to also resolve.
I have no idea why anyone would ever do anything other than resolving.

That's a massive

pfSense was introduced with dnsmaq, a basic forwarder, as back then, there were many ISPs that even didn't allow to talk to other DNS servers as their own DNS (ISP) server.
Our WAN uses DHCP (or comparable), so it assigned us a IP, a gateway, and a (probably two) ISP DNS servers.
And we had no choice.
This changed a decade or so, with bandwidth became less of an issue.

The 'answer' the question differently : ask yourself why Netgate delivers pfSense with an activated resolver ? Maybe this a security thing ? ( ^^ )
Maybe they want you to use autonomous (resolved) DNS and while you're at it DNSSEC ?
I guess I could reverse the question: if you know what DNSSEC is, the 'shall I forward ?' doesn't even exist anymore.
After all : if you want to phone number of 'Paul', what would you do ?
Ask Jack ?
Or ask Paul directly ?
Do you want second-hand info or first hand info ?
Do you want a certified DNS answer, or a 'maybe' answer ?

Noop. I don't know why this is even a question.

KOM

@JonathanLee Always resolver.