I have set up pdns on my host. It works as expected.
if i do a dns query inside my unbound container, it works. and i see it in the trace log of my pdns-recursor.
inside the unbound:
bash-5.0# dig database.clamav.net
; <<>> DiG 9.14.12 <<>> database.clamav.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21415
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;database.clamav.net. IN A
;; ANSWER SECTION:
database.clamav.net. 2 IN CNAME database.clamav.net.cdn.cloudflare.net.
database.clamav.net.cdn.cloudflare.net. 242 IN A 104.16.219.84
database.clamav.net.cdn.cloudflare.net. 242 IN A 104.16.218.84
;; Query time: 2 msec
;; SERVER: 127.0.0.11#53(127.0.0.11)
;; WHEN: Thu Jul 02 22:30:14 CEST 2020
;; MSG SIZE rcvd: 129
that works as expected.
Now as you say rspamd and postfix should use this unbound container for their resolving …
But how can they if the unbound server itself seems to block queries on his mailcow-docker-network ip ??
ash-5.0# dig database.clamav.net @172.11.1.254
; <<>> DiG 9.14.12 <<>> database.clamav.net @172.11.1.254
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 51050
;; flags: qr rd ad; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; Query time: 1 msec
;; SERVER: 172.11.1.254#53(172.11.1.254)
;; WHEN: Thu Jul 02 22:32:59 CEST 2020
;; MSG SIZE rcvd: 12
I had a look at the /etc/unbound.conf file in my unbound container and i see this:
server:
verbosity: 1
interface: 0.0.0.0
interface: ::0
logfile: /dev/console
do-ip4: yes
do-ip6: yes
do-udp: yes
do-tcp: yes
do-daemonize: no
#access-control: 0.0.0.0/0 allow
access-control: 10.0.0.0/8 allow
access-control: 172.16.0.0/12 allow
access-control: 192.168.0.0/16 allow
access-control: fc00::/7 allow
access-control: fe80::/10 allow
#access-control: ::0/0 allow
directory: "/etc/unbound"
username: unbound
meaning my mailcow network 172.11.1.x is not allowed … so that is why i get the refused on the queries to the unbound ….
but this network is created by the mailcow installation … i didn’t choose this myself.
from the mailcow.conf file (=> .env)
# Internal IPv4 /24 subnet, format n.n.n (expands to n.n.n.0/24)
IPV4_NETWORK=172.11.1
Is that ipv4_network range somewhere generated automatically during install ? Then this is a bug