Update 2025-09a - Unbound suddenly unhealthy

bundyland

Hi guys,

I’ve tried to update my machine to the latest version, but unbound doesn’t like to start anymore.
This is what I see in the logs:

docker compose logs unbound-mailcow
unbound-mailcow-1 | Setting console permissions…
unbound-mailcow-1 | Receiving anchor key…
unbound-mailcow-1 | Receiving root hints…
######################################################################## 100.0%
unbound-mailcow-1 | setup in directory /etc/unbound
unbound-mailcow-1 | Certificate request self-signature ok
unbound-mailcow-1 | subject=CN=unbound-control
unbound-mailcow-1 | removing artifacts
unbound-mailcow-1 | Setup success. Certificates created. Enable in unbound.conf file to use
unbound-mailcow-1 | 2025-09-11 12:35:20,834 INFO Set uid to user 0 succeeded
unbound-mailcow-1 | 2025-09-11 12:35:20,847 INFO supervisord started with pid 1
unbound-mailcow-1 | 2025-09-11 12:35:21,897 INFO spawned: ‘processes’ with pid 23
unbound-mailcow-1 | 2025-09-11 12:35:21,909 INFO spawned: ‘syslog-ng’ with pid 24
unbound-mailcow-1 | 2025-09-11 12:35:21,927 INFO spawned: ‘unbound’ with pid 25
unbound-mailcow-1 | 2025-09-11 12:35:21,932 INFO spawned: ‘unbound-healthcheck’ with pid 26
unbound-mailcow-1 | Sep 11 12:35:22 d3214f01cbe8 syslog-ng[24]: syslog-ng starting up; version=‘4.8.1’
unbound-mailcow-1 | [1757586922] unbound[25:0] notice: init module 0: subnetcache
unbound-mailcow-1 | [1757586922] unbound[25:0] notice: init module 1: validator
unbound-mailcow-1 | [1757586922] unbound[25:0] notice: init module 2: iterator
unbound-mailcow-1 | [1757586922] unbound[25:0] info: start of service (unbound 1.22.0).
unbound-mailcow-1 | 2025-09-11 12:35:23,110 INFO success: processes entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
unbound-mailcow-1 | 2025-09-11 12:35:23,110 INFO success: syslog-ng entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
unbound-mailcow-1 | 2025-09-11 12:35:23,110 INFO success: unbound entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
unbound-mailcow-1 | 2025-09-11 12:35:23,110 INFO success: unbound-healthcheck entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
unbound-mailcow-1 | [1757586925] unbound[25:0] info: generate keytag query _ta-4f66-9728. NULL IN
unbound-mailcow-1 | 2025-09-11 12:35:34: Healthcheck: Failed to ping 1.1.1.1 on attempt 1. Trying again…
unbound-mailcow-1 | 2025-09-11 12:35:46: Healthcheck: Failed to ping 1.1.1.1 on attempt 2. Trying again…
unbound-mailcow-1 | 2025-09-11 12:35:58: Healthcheck: Failed to ping 1.1.1.1 on attempt 3. Trying again…
unbound-mailcow-1 | 2025-09-11 12:35:58: Healthcheck: Couldn’t ping 1.1.1.1 after 3 attempts. Marking this IP as failed.
unbound-mailcow-1 | 2025-09-11 12:36:10: Healthcheck: Failed to ping 8.8.8.8 on attempt 1. Trying again…
unbound-mailcow-1 | 2025-09-11 12:36:22: Healthcheck: Failed to ping 8.8.8.8 on attempt 2. Trying again…
unbound-mailcow-1 | 2025-09-11 12:36:34: Healthcheck: Failed to ping 8.8.8.8 on attempt 3. Trying again…
unbound-mailcow-1 | 2025-09-11 12:36:34: Healthcheck: Couldn’t ping 8.8.8.8 after 3 attempts. Marking this IP as failed.
unbound-mailcow-1 | 2025-09-11 12:36:46: Healthcheck: Failed to ping 9.9.9.9 on attempt 1. Trying again…
unbound-mailcow-1 | 2025-09-11 12:36:58: Healthcheck: Failed to ping 9.9.9.9 on attempt 2. Trying again…
unbound-mailcow-1 | 2025-09-11 12:37:10: Healthcheck: Failed to ping 9.9.9.9 on attempt 3. Trying again…
unbound-mailcow-1 | 2025-09-11 12:37:10: Healthcheck: Couldn’t ping 9.9.9.9 after 3 attempts. Marking this IP as failed.
unbound-mailcow-1 | 2025-09-11 12:37:10: Healthcheck: Too many ping failures (1 failures allowed, you got 3 failures), marking Healthcheck as unhealthy…
unbound-mailcow-1 | 2025-09-11 12:37:14: Healthcheck: DNS Resolution Failed on attempt 1 for hub.docker.com! Trying again…

This is very strange, because till version 2025-07 I never had any problems before. My server runs Mailcow only (no other services like VPN etc.) and is a KVM with Debian 13.

Anybody else here with the same problem or (even better) a possible solution?

Thank you!

DocFraggle

I just updated my testcow, it’s working normally.

Are you blocking ICMP outgoing? Try this inside the container:

root@testcow:/opt/mailcow-dockerized# docker compose exec unbound-mailcow /bin/bash 
fda0c3f81889:/# ping 1.1.1.1
PING 1.1.1.1 (1.1.1.1): 56 data bytes
64 bytes from 1.1.1.1: seq=0 ttl=57 time=16.200 ms
64 bytes from 1.1.1.1: seq=1 ttl=57 time=14.872 ms
64 bytes from 1.1.1.1: seq=2 ttl=57 time=14.596 ms
64 bytes from 1.1.1.1: seq=3 ttl=57 time=14.846 ms
^C
--- 1.1.1.1 ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
round-trip min/avg/max = 14.596/15.128/16.200 ms

bundyland

DocFraggle

Thank you for your response.

No, I’m not blocking anything, but will try the ping inside the container as you suggested.
Will let you know the results tomorrow.

bundyland

DocFraggle

Problem fixed.
As I haven’t found any other solution, I just have flushed iptables and restarted docker.
Now unbound is able to ping to 1.1.1.1 etc.

Thank you once again for your help.

Cheers…