2

I have configured Unbound to use DNS over TLS using the following configuration. How can I configure Unbound to validate the upstream certificate against a hostname?

forward-zone:
        name: "."
        forward-addr: 1.1.1.1@853
        forward-addr: 1.0.0.1@853
        forward-addr: 2606:4700:4700::1111@853
        forward-addr: 2606:4700:4700::1001@853
        forward-tls-upstream: yes
3

The bug report for adding support for validating the upstream DNS server's certificate was resolved on April 19, 2018.

Adapting the example from comment 9:

server:
        tls-cert-bundle: "/etc/pki/tls/certs/ca-bundle.crt"
forward-zone:
        name: "."
        forward-addr: 1.1.1.1#cloudflare-dns.com
        forward-addr: 1.0.0.1#cloudflare-dns.com
        forward-addr: 2606:4700:4700::1111#cloudflare-dns.com
        forward-addr: 2606:4700:4700::1001#cloudflare-dns.com
        forward-tls-upstream: yes

There's also an explanation of how it works - the hashtag name allows for the tls authentication name to be set for stub-zones and with unbound-control forward control commands. There should be no spaces around the '@' and '#'.

  • Credit to @jwh, but apparently I'm not able to edit their answer to include an example. – Bardi Harborow May 2 '18 at 3:34
2

Unfortunately, you can not. There is an unresolved bug for this:

unbound using TLS in a forwarding configuration does not verify the server's certificate

So with Unbounds DNS over TLS your requests can be intercepted.

1

The bug for "unbound using TLS in a forwarding configuration does not verify the server's certificate" was resolved on 19 Apr 2018:

TLS authentication for forwarders.

The syntax is forward-addr: [@port][#tls-authentication-name] And the ca bundle can be set with: tls-cert-bundle: "ca-bundle.pem" (or the ca-bundle.crt file).

Example server: tls-cert-bundle: "/etc/pki/tls/certs/ca-bundle.crt" forward-zone: name: "." forward-tls-upstream: yes forward-addr: 9.9.9.9@853#dns.quad9.net forward-addr: 1.1.1.1@853#cloudflare-dns.com

The hashtag name trick makes it so that the tls authentication name can also be set for eg. stub-zones and with unbound-control forward control commands. It was also easier in the code. There should be no spaces around the '@' and '#'.

The port number is [...] 853 when you specify a tls authname. (And still 53 for others).

Ref: comment 9.

  • As is, its a bit of a link only answer. It would be useful to integrate some of the information from the appropriate email into your post. – Journeyman Geek May 2 '18 at 3:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.