unbound unhealthy, unable to lookup domain at localhost

arvinqwq

The unbound container is unhealthy.

Here is the log

port 53 of the container is open

unable to dig domain, time out

port 53 listening

unbound running

esackbauer

Are you on a supported platform? Docker and docker compose on latest releases?
UFW or Firewalld deactivated? SELinux deactivated?

arvinqwq

esackbauer
Platform: Debian 12
Docker version 28.3.0, build 38b7060

Docker Compose version v2.37.3

About firewall:

SELinux: disabled

esackbauer

Check that you have the required ports open for outgoing traffic:
https://docs.mailcow.email/getstarted/prerequisite-system/#outgoing-portshosts
Also read further regarding Hetzner firewall (or other cloud VPS with static firewalls).

Does dig work from your debian host, for a query to the root server? Unbound must be able to reach the root servers.

arvinqwq

esackbauer Dig works for the debian host:

And here are tests for the outgoing traffic, it seems that they all work well…

This server is on the home network, so there’s no VPS firewall.

I cannot figure out why unbound failed to dig at itself…

esackbauer

Hm. the only thing then that comes to my mind that you changed something in docker network config.
Which server has 172.16.0.1? What is its netmask?
Did you change in mailcow.conf IPV4_NETWORK=172.22.1?

arvinqwq

esackbauer
The system was newly installed, and I used the script in the document to install docker, i.e.,

curl -sSL https://get.docker.com/ | CHANNEL=stable sh
systemctl enable --now docker

I think I didn’t modify the docker network as the only thing I do after downloading from github was to run ./generate_config.sh, docker compose pull and docker compose up -d, so it was really strange… I just followed the instructions but ran into such a problem…

172.16.0.1 is the router (openwrt), netmask is 255.255.255.0, the address of the debian server is 172.16.0.233

and here’s IPV4_NETWORK

root@debian:/opt/mailcow-dockerized# cat mailcow.conf | grep IPV4_NETWORK
IPV4_NETWORK=172.22.1

esackbauer

Then I am out of ideas for now.
But there are a lot of threads here regarding that issue, have you searched for them? Or in github issues?

You could try to do one more

docker compose down
docker compose up -d

and maybe rerun update.sh or reboot the whole server. Maybe docker-iptables has a hiccup

arvinqwq

esackbauer
I’ve read several threads about unbound issue, and tried their methods, but didn’t work.
Issues on github about unbound are different from my situation.
After updating, the unbound is still unable to resolve domain…
This problem has been bothering me for a few days, and rebooting did not help either 😢

Anyway, thanks for your time and effort!

arvinqwq

esackbauer
I solved the problem… but not completely
I tried to deploy it on a laptop (ubuntu), and failed again. Then, I connected my laptop to another network, and succeeded…
It seems to be the problem of openwrt network, as there have been strange situations before…
Maybe I should check it carefully 😆