问题描述
我在测试服务器上运行了一个 Unbound 容器来代理 DNS 流量。问题是它对某些域失败，而对其他所有域都完美。
这是对使用 dig 的失败域的响应：
dig @127.0.0.1 mail.protonmail.com
; <<>> DiG 9.11.5-P4-5.1+deb10u5-Debian <<>> @127.0.0.1 mail.protonmail.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,status: SERVFAIL,id: 24960
;; flags: qr rd ra; QUERY: 1,ANSWER: 0,AUTHORITY: 0,ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; ednS: version: 0,flags:; udp: 1232
;; QUESTION SECTION:
;mail.protonmail.com. IN A
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu Jul 01 11:56:23 UTC 2021
;; MSG SIZE rcvd: 48
查看日志我得到了一些有趣的信息：
info: resolving mail.protonmail.com. A IN
info: error sending query to auth server 2001:503:39c1::30 port 53
info: error sending query to auth server 2001:503:a83e::2:30 port 53
info: error sending query to auth server 2001:502:7094::30 port 53
info: error sending query to auth server 2001:503:39c1::30 port 53
info: resolving com. DNSKEY IN
info: response for mail.protonmail.com. A IN
info: reply from <com.> 192.35.51.30#53
info: query response was REFERRAL
info: resolving ns3.protonmail.com. AAAA IN
info: resolving ns2.protonmail.com. AAAA IN
info: resolving protonmail.com. DNSKEY IN
info: resolving ns1.protonmail.com. AAAA IN
info: response for ns3.protonmail.com. AAAA IN
info: reply from <protonmail.com.> 3.127.12.149#53
info: query response was ANSWER
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
info: response for mail.protonmail.com. A IN
info: reply from <protonmail.com.> 185.70.40.19#53
info: query response was ANSWER
info: validated DS protonmail.com. DS IN
info: response for ns2.protonmail.com. AAAA IN
info: reply from <protonmail.com.> 185.70.41.19#53
info: query response was ANSWER
info: response for ns1.protonmail.com. AAAA IN
info: reply from <protonmail.com.> 185.70.41.19#53
info: query response was ANSWER
info: response for ns3.protonmail.com. AAAA IN
info: reply from <protonmail.com.> 185.70.41.19#53
info: query response was nodata ANSWER
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
info: response for ns2.protonmail.com. AAAA IN
info: reply from <protonmail.com.> 185.70.41.19#53
info: query response was nodata ANSWER
info: response for ns1.protonmail.com. AAAA IN
info: reply from <protonmail.com.> 185.70.40.19#53
info: query response was nodata ANSWER
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
info: resolving ns2.protonmail.com. AAAA IN
info: resolving protonmail.com. DNSKEY IN
info: response for protonmail.com. DNSKEY IN
info: reply from <com.> 192.48.79.30#53
info: query response was REFERRAL
info: resolving ns3.protonmail.com. AAAA IN
info: resolving ns2.protonmail.com. AAAA IN
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
info: resolving ns1.protonmail.com. AAAA IN
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
info: resolving ns3.protonmail.com. AAAA IN
info: resolving ns3.protonmail.com. A IN
info: error sending query to auth server 2001:502:7094::30 port 53
info: response for ns3.protonmail.com. AAAA IN
info: reply from <com.> 192.41.162.30#53
info: query response was REFERRAL
info: resolving ns1.protonmail.com. AAAA IN
info: response for ns3.protonmail.com. A IN
info: reply from <com.> 192.31.80.30#53
info: query response was REFERRAL
info: resolving ns2.protonmail.com. AAAA IN
info: response for ns3.protonmail.com. AAAA IN
info: reply from <protonmail.com.> 185.70.41.19#53
info: query response was nodata ANSWER
info: response for ns3.protonmail.com. A IN
info: reply from <protonmail.com.> 185.70.40.19#53
info: query response was ANSWER
info: resolving ns2.protonmail.com. AAAA IN
info: error sending query to auth server 2001:500:d937::30 port 53
info: resolving ns2.protonmail.com. A IN
info: response for ns2.protonmail.com. A IN
info: reply from <com.> 192.43.172.30#53
info: query response was REFERRAL
info: response for ns2.protonmail.com. AAAA IN
info: reply from <com.> 192.43.172.30#53
info: query response was REFERRAL
info: response for ns2.protonmail.com. AAAA IN
info: reply from <protonmail.com.> 3.127.12.149#53
info: query response was nodata ANSWER
info: response for ns2.protonmail.com. A IN
info: reply from <protonmail.com.> 185.70.40.19#53
info: query response was ANSWER
info: resolving ns1.protonmail.com. AAAA IN
info: resolving ns1.protonmail.com. A IN
info: error sending query to auth server 2001:503:d2d::30 port 53
info: error sending query to auth server 2001:500:d937::30 port 53
info: error sending query to auth server 2001:503:eea3::30 port 53
info: error sending query to auth server 2001:501:b1f9::30 port 53
info: response for ns1.protonmail.com. A IN
info: reply from <com.> 192.43.172.30#53
info: query response was REFERRAL
info: response for ns1.protonmail.com. AAAA IN
info: reply from <com.> 192.55.83.30#53
info: query response was REFERRAL
info: response for ns1.protonmail.com. AAAA IN
info: reply from <protonmail.com.> 3.127.12.149#53
info: query response was nodata ANSWER
info: response for ns1.protonmail.com. A IN
info: reply from <protonmail.com.> 185.70.40.19#53
info: query response was ANSWER
info: Missing DNSKEY RRset in response to DNSKEY query.
info: resolving protonmail.com. DNSKEY IN
info: resolving ns2.protonmail.com. AAAA IN
info: resolving ns3.protonmail.com. AAAA IN
info: resolving ns1.protonmail.com. AAAA IN
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
info: Missing DNSKEY RRset in response to DNSKEY query.
info: resolving protonmail.com. DNSKEY IN
info: resolving ns2.protonmail.com. AAAA IN
info: resolving ns3.protonmail.com. AAAA IN
info: resolving ns1.protonmail.com. AAAA IN
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
info: Missing DNSKEY RRset in response to DNSKEY query.
info: resolving protonmail.com. DNSKEY IN
info: resolving ns2.protonmail.com. AAAA IN
info: resolving ns3.protonmail.com. AAAA IN
info: resolving ns1.protonmail.com. AAAA IN
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
info: Missing DNSKEY RRset in response to DNSKEY query.
info: resolving protonmail.com. DNSKEY IN
info: resolving ns2.protonmail.com. AAAA IN
info: resolving ns3.protonmail.com. AAAA IN
info: resolving ns1.protonmail.com. AAAA IN
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
info: Missing DNSKEY RRset in response to DNSKEY query.
info: resolving protonmail.com. DNSKEY IN
info: resolving ns2.protonmail.com. AAAA IN
info: resolving ns3.protonmail.com. AAAA IN
info: resolving ns1.protonmail.com. AAAA IN
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.40.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
info: **Missing DNSKEY RRset in response to DNSKEY query.**
info: **Could not establish a chain of trust to keys for protonmail.com. DNSKEY IN**
Unbound 在 docker 容器内运行，并根据本地时间与主机同步（最初未同步，但我想我应该尝试看看是否存在错误）。
未绑定配置：
server:
cache-max-ttl: 86400
cache-min-ttl: 300
directory: "/opt/unbound/etc/unbound"
edns-buffer-size: 1232
interface: 0.0.0.0@53
rrset-roundrobin: yes
username: "_unbound"
log-local-actions: no
log-queries: no
log-replies: no
log-servfail: no
logfile: /var/log/unbound.log
verbosity: 2
aggressive-nsec: yes
delay-close: 10000
do-daemonize: no
do-not-query-localhost: no
neg-cache-size: 4M
qname-minimisation: yes
access-control: 127.0.0.1/32 allow
access-control: 192.168.0.0/16 allow
access-control: 172.16.0.0/12 allow
access-control: 10.0.0.0/8 allow
auto-trust-anchor-file: "var/root.key"
chroot: "/opt/unbound/etc/unbound"
deny-any: yes
harden-algo-downgrade: yes
harden-below-nxdomain: yes
harden-dnssec-stripped: yes
harden-glue: yes
harden-large-queries: yes
harden-referral-path: no
harden-short-bufsize: yes
hide-identity: yes
hide-version: yes
identity: "foo"
private-address: 10.0.0.0/8
private-address: 172.16.0.0/12
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: fd00::/8
private-address: fe80::/10
private-address: ::ffff:0:0/96
ratelimit: 1000
tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
unwanted-reply-threshold: 10000
use-caps-for-id: no
val-clean-additional: yes
infra-cache-slabs: 2
incoming-num-tcp: 10
key-cache-slabs: 2
msg-cache-size: 275724970
msg-cache-slabs: 2
num-queries-per-thread: 4096
num-threads: 1
outgoing-range: 8192
rrset-cache-size: 551449941
rrset-cache-slabs: 2
minimal-responses: yes
prefetch: yes
prefetch-key: yes
serve-expired: yes
so-reuseport: yes
remote-control:
control-enable: no
有什么想法吗？
编辑：如果我在我的 PC 上运行相同的容器 - 查询有效，所以我猜它是 docker 主机上的某种服务器配置
解决方法
您的问题很可能出在这些行上：
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 185.70.41.19 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
error: tcp sendmsg: Operation not supported for 3.127.12.149 port 53
这表示您的 DNS 服务器未能将 DNS over TCP 查询发送出站，这是与任何返回 DNS 响应且设置了 TC（截断）位的 DNS 服务器进行通信所必需的，表明它需要发送的数据超过将适合响应[警告：遗漏了很多关于服务器端如何决定的细节]。因为您的 DNS 解析器正在使用 DNSSEC 验证查询（理想情况下是您想要的），所以一些响应很大并且需要 TCP（DNSKEY 传输很大）也就不足为奇了。
按优先顺序排列的解决方案：
- 在主机或 docker 容器中的一个/两个上修复 outbout TCP
- 将
edns-buffer-size: 1232增加到 4096 之类的值。这会导致 UDP 数据包碎片化，但至少它可能对您有用。理想情况下，1232 是一个更好的值，但如果您无法修复 TCP，这可能是唯一的选择 - 关闭 DNSSEC 验证。您可以通过在配置文件中设置
module-config: "iterator"选项来实现此目的，但随后您将失去 DNSSEC 为您提供的安全支持。