DNS resolve fails for local domain

MrH

I have configured a forward-zone to my local dns-server (other host) in the unbound.conf, but it seems that only the unbound-container uses this.
When I do a ‘dig’ in other containers (I’m primarily interested in watchdog for now) it returns nothing.
Running a ‘dig +trace’ returns my public ipaddress.
I would expect the forward-zone to give the local ip.
The goal is to have watchdog send messages through the webhook (which runs locally).
How can I have the internal ipaddress returned in the (all) container(s), assuming they all use the unbound-container to resolve ipaddresses?

Kevo

Is your docker machine using the local DNS server?

MrH

Yes it is (local as the dns server for my domain, which runs on another host)

ETNyx

Hi there,

dig +trace is the wrong tool for debugging this. By design it starts from the root servers and does the resolution itself, so it never asks unbound and never touches your forward-zone. Getting your public IP back is expected and doesn’t tell you anything about whether forwarding works.

I’d start where you actually need it to work:

docker compose exec watchdog-mailcow dig @172.22.1.254 webhook.example.com
docker compose exec watchdog-mailcow dig webhook.example.com

Assuming 172.22.1.254 is unbound container,..

The first asks unbound directly, the second uses the container’s normal path. If the first works and the second doesn’t, the problem is Docker’s embedded DNS rather than your forward-zone. If neither works, it’s unbound itself.

MrH

Thanks!

I tried several options and the results are below.

# docker compose exec watchdog-mailcow dig  webhook.example.com

; <<>> DiG 9.20.20 <<>> webhook.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 20197
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;webhook.example.com.			IN	A

;; Query time: 8 msec
;; SERVER: 127.0.0.11#53(127.0.0.11) (UDP)
;; WHEN: Sun Aug 23 11:21:02 CEST 2026
;; MSG SIZE  rcvd: 32

# docker compose exec watchdog-mailcow dig @172.22.1.254 webhook.example.com

; <<>> DiG 9.20.20 <<>> @172.22.1.254 webhook.example.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 24121
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;webhook.example.com.			IN	A

;; Query time: 0 msec
;; SERVER: 172.22.1.254#53(172.22.1.254) (UDP)
;; WHEN: Sun Aug 23 11:21:27 CEST 2026
;; MSG SIZE  rcvd: 43

Running bash in unbound-mailcow with

# docker compose exec unbound-mailcow bash

and running the following two commands returned this

# dig webhook.example.com

; <<>> DiG 9.20.23 <<>> webhook.example.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37241
;; flags: qr rd; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;webhook.example.com.			IN	A

;; ANSWER SECTION:
webhook.example.com.		60	IN	CNAME	proxy.example.local.
proxy.example.local.	60	IN	A	192.168.20.44

;; Query time: 4 msec
;; SERVER: 127.0.0.11#53(127.0.0.11) (UDP)
;; WHEN: Sun Aug 23 11:22:00 CEST 2026
;; MSG SIZE  rcvd: 89

# dig webhook.example.com @172.22.1.254

; <<>> DiG 9.20.23 <<>> webhook.example.com @172.22.1.254
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 54079
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;webhook.example.com.			IN	A

;; Query time: 16 msec
;; SERVER: 172.22.1.254#53(172.22.1.254) (UDP)
;; WHEN: Sun Aug 23 11:22:34 CEST 2026
;; MSG SIZE  rcvd: 43

Removing the forward-zone make unbound resolve the ip, but it returns my public ip instead of the internal ip of the server (obviously).

ETNyx

A fast SERVFAIL like that is a typical sign of DNSSEC validation failing, which you can test with +cd (checking disabled). The other candidate is the CNAME target: your local server answers with a CNAME to proxy.example.local, is that zone covered by your forward-zone? So unbound goes to the root, finds there is no .local TLD and gives up.

docker compose exec watchdog-mailcow dig +cd @172.22.1.254 webhook.example.com
docker compose exec watchdog-mailcow dig @172.22.1.254 proxy.example.local

MrH

I have example.local also as a forward-zone in my unbound.conf.
Using +cd does return the right ipaddress.

ETNyx

Ok so it’s DNSSEC. You can bypass validation for just those names in your unbound config:

server:
    domain-insecure: "webhook.example.com"
    domain-insecure: "example.local"

Restart unbound, test without +cd.

MrH

Awesome. That worked!

Thanks!