Re: New document on Unbound caching DNS server

Quoting Steve Litt ([email protected]):

> The Unbound DNS server is the new kid on the block. A lot of admins are
> replacing BIND9 with Unbound, perhaps plus an authoritative DNS server
> for their domain. 

Strictly speaking, that's a fruit-basket to orange comparison.  Unbound
doesn't replace BIND9.  It replaces one function of BIND9.

Quoting from the table of contents in my page
http://linuxmafia.com/faq/Network_Other/dns-servers.html:

  o  BIND9: authoritative, recursive, AXFR, client
  o  Unbound: recursive[1]

> More interesting still, a lot of laptop owners are installing Unbound
> to replace their old 8.8.8.8 or per-accesspoint resolvers with a full
> caching DNS, which is more secure, faster, and makes for much faster
> browsing.
> 
> At  http://troubleshooters.com/linux/unbound_nsd/unbound.htm  I've 
> created a new document detailing the installation and setup of Unbound,

Thanks.  Skim reading it now.

   according to its Web site, [Unbound] also does recursive queries,
   although I'm not sure exactly what they mean by that

It means it complies with the request implied by the 'RD' bit (recursion
desired) being set on a query.  That bit being set loosely translates to
'Just go ahead and chase through as many delegations as necessary to get
me the answer, rather than making me, the DNS client, micromanage the
delegation process and climb the delegation hierarchy until we get
answers.

I explain the recursive vs. iterative difference in my 2010 article 'The
Village of Lan: A Networking Fairy Tale':

  Dwayne is a nameserver offering iterative service only (running
  dproxy). You can get any DNS answer out of him _eventually_, but he's not
  willing to bounce around the state following leads. A conversation with
  Dwayne is sort of punctuated:

  "Do you know where uncle-enzo.linuxmafia.com is?" "No."
  "Well, do you know who knows?" "No."
  "Well, do you know who knows where to find .com nameservers?" "No."
  "Well, can you ask the root nameserver where to find .com nameservers?"
  "OK." [Gives list of 13.]
  "Can you ask .com nameserver #1 who answers for linuxmafia.com?" "OK."
  [Gets list of five nameserver IPs.]
  "Can you ask linuxmafia.com nameserver #1 where
  uncle-enzo.linuxmafia.com is?" "OK." [Queries and gets answer.]


In contrast to:

  Ralph is a recursive nameserver (an instance of PowerDNS Recursor).
  Ralph is a born researcher: He doesn't have any DNS knowledge of his own
  (offers no authoritative service), but absolutely lives for finding out
  what DNS data can be unearthed from guys in other villages. If you ask
  him a DNS question, he'll figure out whom to ask, go there regardless of
  where it takes him, if necessary chase around the state following leads,
  and only bother you when he has the final answer. (This is the
  "recursive" part. Compare with the iterative approach.) Like
  everyone else in this village except Larry, he has a good memory
  (caching).

  Let's say, Larry asks Ralph, "What's uncle-enzo.linuxmafia.com?" In the
  worst case, if Ralph is just back from vacation (has a depleted cache),
  Ralph goes off for a while, and says: "I looked on my desk to see if the
  answer were there (in cache), but it wasn't. So, I checked to see if
  answers to the question 'Where are nameservers for the linuxmafia.com
  domain?' were there, but they weren't either. So, I check to see if
  answers to the question 'Where are nameservers for the .com top-level
  domain?' were there, but they weren't either. So, I finally fell back on
  my Rolodex's list of 13 IP addresses of root nameservers, picked one,
  and visited it. I asked it where I can get answers to .com questions. It
  gave me a list of .com nameserver IPs. I picked one, visited it, and
  asked who knows about linuxmafia.com DNS matters. It gave me a list of
  linuxmafia.com IPs, I picked one, visited it, asked it where
  uncle-enzo.linuxmafia.com is, brought the answer back, and here y'are.
  Oh, and I've made a note who knows where .com information is, where
  specifically linuxmafia.com information is, and also where
  uncle-enzo.linuxmafia.com is, just in case I'm asked again."

Give the article a try:  You might find it amusing.
http://linuxmafia.com/~rick/lan.html


Returning to your article

    A caching DNS server

Ugh.  I really wish someone would take that phrase out and garrote it, 
because all DNS software (except authoritative-only daemons) does
caching, so saying a server is 'caching' tells you nothing useful.

IMO, your terminology, there, is a problem, as it suggests a category
distinction that really isn't real and isn't the issue.

   Unbound is capable of passing queries to authoritative servers

Well, I would _hope_ so.  If it couldn't, it would never get any data 
at all.  That's the only place the data ultimately comes from, you know.

   Unbound can also resolve local LAN hosts via its local-zone,
   local-data, and local-data-ptr server commands in its configuration
   file. In other words, instead of delegating authority to another server,
   Unbound can do authoritative DNS, to a limited degree, all by itself.

Um, the alternative scenario isn't _delegation_, but rather consulting
data at or derived from authoritative servers.

   Unbound is fast becoming the go-to DNS caching server, replacing Bind

No, it's fast becoming the go-to _recursive_ DNS nameserver, replacing the 
_recursive_ functionality of BIND9.