qdm12 / dns Goto Github PK

View Code? Open in Web Editor NEW

214.0 12.0 37.0 1.96 MB

Docker DNS server on steroids to access DNS-over-TLS from Cloudflare, Google, Quad9, Quadrant or CleanBrowsing

Home Page: https://hub.docker.com/r/qmcgaw/cloudflare-dns-server

License: MIT License

Dockerfile 2.72% Go 97.28%

dns-server dns-over-tls unbound cloudflare-dns docker google-dns quad9 quadrant cleanbrowsing

dns's Introduction

DNS over TLS upstream server Docker container

DNS over TLS upstream server connected to DNS over TLS (IPv4 and IPv6) servers with DNSSEC, DNS rebinding protection, built-in Docker healthcheck and fine grain IPs + hostnames blocking

Announcement: *You can now try :v2.0.0-beta with this documentation.

The :latest Docker image might break compatibility in the coming days/weeks

Features

It can be connected to one or more of the following DNS-over-TLS providers:
Split-horizon DNS (randomly pick one of the DoT providers specified for each request)
Block hostnames and IP addresses for 3 categories: malicious, surveillance and ads
Block custom hostnames and IP addresses using environment variables
One line setup
Runs without root
Small 41.1MB Docker image (uncompressed, amd64)
- Alpine 3.14
- Unbound 1.13.1 from Alpine packages
- Files and lists built periodically
- Go static binary entrypoint built from this source
Resolves using IPv4 and IPv6 when available
Auto updates block lists and cryptographic files every 24h and restarts Unbound (< 1 second downtime)
Compatible with amd64, i686 (32 bit), ARM 64 bit, ARM 32 bit v7 and ppc64le 🎆
DNS rebinding protection
DNSSEC Validation

Diagrams are shown for router and client-by-client configurations in the Connect clients to it section.

Setup

⚠️ Raspberry Pi users running 32 bit systems, you need to do this on your host to run the container.
Launch the container with
```
docker run -d -p 53:53/udp qmcgaw/dns
```
You can also use docker-compose.yml with:
```
docker-compose up -d
```
More environment variables are described in the environment variables section.
See the Connect clients to it section, you can also refer to the Verify DNS connection section if you want.

If you run an old Docker version or Kernel, you might want to run the container as root with --user="0" (see this issue for context).

Docker tags 🐳

Docker image	Github release
`qmcgaw/dns:latest`	Master branch
`qmcgaw/dns:v1.5.1`	v1.5.1
`qmcgaw/dns:v1.4.1`	v1.4.1
`qmcgaw/dns:v1.2.1`	v1.2.1
`qmcgaw/dns:v1.1.1`	v1.1.1
`qmcgaw/cloudflare-dns-server:latest`	Master branch
`qmcgaw/cloudflare-dns-server:v1.0.0`	v1.0.0

💁 qmcgaw/cloudflare-dns-server:latest mirrors qmcgaw/dns:latest

Environment variables

Environment variable	Default	Description
`PROVIDERS`	`cloudflare`	Comma separated list of DNS-over-TLS providers from `cira family`, `cira private`, `cira protected`, `cleanbrowsing adult`, `cleanbrowsing family`, `cleanbrowsing security`, `cloudflare`, `cloudflare family`, `cloudflare security`, `google`, `libredns`, `quad9`, `quad9 secured`, `quad9 unsecured` and `quadrant`
`VERBOSITY`	`1`	From 0 (no log) to 5 (full debug log)
`VERBOSITY_DETAILS`	`0`	From 0 to 4 (higher means more details)
`BLOCK_MALICIOUS`	`on`	`on` or `off`, to block malicious IP addresses and malicious hostnames from being resolved
`BLOCK_SURVEILLANCE`	`off`	`on` or `off`, to block surveillance IP addresses and hostnames from being resolved
`BLOCK_ADS`	`off`	`on` or `off`, to block ads IP addresses and hostnames from being resolved
`BLOCK_HOSTNAMES`		comma separated list of hostnames to block from being resolved
`BLOCK_IPS`		comma separated list of IPs to block from being returned to clients
`UNBLOCK`		comma separated list of hostnames to leave unblocked
`LISTENINGPORT`	`53`	UDP port on which the Unbound DNS server should listen to (internally)
`CACHING`	`on`	`on` or `off`. It can be useful if you have another DNS (i.e. Pihole) doing the caching as well on top of this container
`PRIVATE_ADDRESS`	All IPv4 and IPv6 CIDRs private ranges	Comma separated list of CIDRs or single IP addresses. Note that the default setting prevents DNS rebinding
`CHECK_DNS`	`on`	`on` or `off`. Check resolving github.com using `127.0.0.1:53` at start
`IPV4`	`on`	`on` or `off`. Uses DNS resolution for IPV4
`IPV6`	`off`	`on` or `off`. Uses DNS resolution for IPV6. Do not enable if you don't have IPV6
`UPDATE_PERIOD`	`24h`	Period to update block lists and restart Unbound. Set to `0` to disable.

Extra configuration

You can bind mount an Unbound configuration file include.conf to be included in the Unbound server section with -v $(pwd)/include.conf:/unbound/include.conf:ro, see Unbound configuration documentation

Golang API

If you want to use the Go code I wrote, you can see tiny examples of DoT and DoH resolvers and servers using the API developed.

Connect clients to it

Option 1: Router (recommended)

All machines connected to your router will use the 1.1.1.1 encrypted DNS by default

Configure your router to use the LAN IP address of your Docker host as its primary DNS address.

Access your router page, usually at http://192.168.1.1 and login with your credentials
Change the DNS settings, which are usually located in Connection settings / Advanced / DNS server
If a secondary fallback DNS address is required, use a dull ip address such as the router's IP 192.168.1.1 to force traffic to only go through this container

To ensure network clients cannot use another DNS, you might want to

Block the outbound UDP 53 port on your router firewall
Block the outbound TCP 853 port on your router firewall, except from your Docker host
If you have Deep packet inspection on your router, block DNS over HTTPs on port TCP 443

Option 2: Client, one by one

You have to configure each machine connected to your router to use the Docker host as their DNS server.

Docker containers

Connect other Docker containers by specifying the DNS to be the host IP address 127.0.0.1:

docker run -it --rm --dns=127.0.0.1 alpine

For docker-compose.yml:

version: '3'
services:
  test:
    image: alpine:3.11
    network_mode: bridge
    dns:
      - 127.0.0.1

If the containers are in the same Docker network, you can simply set the dns to the LAN IP address of the DNS container (i.e. 10.0.0.5)

Windows

Open the control panel and follow the instructions shown on the screenshots below.

Enter the IP Address of your Docker host as the Preferred DNS server (192.168.1.210 in my case) You can set the Cloudflare DNS server address 1.1.1.1 as an alternate DNS server although you might want to leave this blank so that no domain name request is in plaintext.

When closing, Windows should try to identify any potential problems. If everything is fine, you should see the following message:

Mac OS

Follow the instructions at https://support.apple.com/kb/PH25577

Linux

You probably know how to do that. Otherwise you can usually modify the first line of /etc/resolv.conf by changing the IP address of your DNS server.

Android

See this

iOS

See this

Firewall considerations

This container requires the following connections:

UDP 53 Inbound (only if used externally)
TCP 853 Outbound to 1.1.1.1 and 1.0.0.1

Verify DNS connection

Verify that you use Cloudflare DNS servers: https://www.dnsleaktest.com with the Standard or Extended test
Verify that DNS SEC is enabled: https://en.internet.nl/connection

Note that https://1.1.1.1/help does not work as the container is not a client to Cloudflare servers but a forwarder intermediary. Hence https://1.1.1.1/help does not detect a direct connection to them.

Go API

Some packages are exposed publicly through the pkg directory.

The API is at v1.x.x but (shame on me) is not stable and subject to change without changing major version. If you need it to be stable, please create an issue and I'll see what I can do.

For now, it is used by the gluetun project for its DNS over TLS usage.

Development

Development setup

Using VSCode and Docker

Install Docker
- On Windows, share a drive with Docker Desktop and have the project on that partition
- On OSX, share your project directory with Docker Desktop
With Visual Studio Code, install the remote containers extension
In Visual Studio Code, press on F1 and select Remote-Containers: Open Folder in Container...
Your dev environment is ready to go!... and it's running in a container 👍

Locally

Install Go, Docker and Git
Install dependencies
```
go mod download
```
Install golangci-lint

Commands available

# Build the binary
go build cmd/main.go
# Test the code
go test ./...
# Lint the code
golangci-lint run
# Build the Docker image
docker build -t qmcgaw/dns .

See Contributing for more information on how to contribute to this repository.

dns's People

Contributors

Stargazers

Watchers

dns's Issues

DNS requests exposed to ISP

Thanks for sharing this setup. Just a quick question with the router (or client setups) it looks like dns requests are unencrypted from the router to the hosted dns server, after that they are encrypted to 1.1.1.1? So it looks like an isp will still be able to see plaintext dns request before they are encrypted further down the chain.

Currently I have my dns requests going to my docker based openvpn server and then onto 1.1.1.1 with dhcp-option DNS 1.1.1.1 in he.ovpn config. This I think keeps the dns requests from my isp but are unencrypted from the vpn to Cloudflare.

Is there a way for the vpn to pass dns requests over to the cloudfare-dns-server container so that dns requests coming from the router are encrypted over the vpn tunnel and then encrypted by dns over tls?

(My router doesn’t have open firmware so it doesn’t support dns over tls from router direct to cloudflare which would be an alternative way to set things up)

does not work after reboot

$ docker-compose up everything works as expected
$ sudo reboot

It does not work anymore...

$ docker-compose logs
ERROR cannot write to file "/unbound/root.hints": open /unbound/root.hints: permission denied

docker-compose down and docker-compose up again and everything is back to normal. Any idea on how to make sure the container/service functions properly after a reboot?

Request to add an additional DNS provider - https://securedns.eu/

It would be absolutely cool if SecureDNS could be included as an additional selectable DNS provider. SecureDNS could also be used directly as an adblocker, by using a corresponding tls-hostname - see here: https://securedns.eu/

Sorry if I post wrong here, but I'm new here and have not found another way ... and I´am just a enduser.

Thank you!

Security Alert

image (alpine 3.11.5)

Title	Severity	CVE	Package Name	Installed Version	Fixed Version	References
openssl: Segmentation fault in SSL_check_chain causes denial of service	HIGH	CVE-2020-1967	openssl	1.1.1d-r3	1.1.1g-r0	http://www.openwall.com/lists/oss-security/2020/04/22/2 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1967 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1 https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc https://www.debian.org/security/2020/dsa-4661 https://www.openssl.org/news/secadv/20200421.txt

v2 program

Is there anyway to verify that the DoT is working?

Since we cannot use 1.1.1.1/help - is there any other way that we can verify that our connection to Cloudflare is indeed over TLS?

loooong latency

I am experiencing long ping times using the service. When I ping 1.1.1.1 (no TLS) on the host or within the container, times are usually below 30ms. Pi-hole, however, reports 100 to even 1000ms. Is what I measure the trade off of using 'over TLS'?

Health check issues

Docker container running in OSX

suffix:~ admin$ docker ps
CONTAINER ID        IMAGE                          COMMAND                  CREATED             STATUS                           PORTS                                                                                         NAMES
757b6cb36397        qmcgaw/cloudflare-dns-server   "/bin/sh -c /etc/unb…"   43 hours ago        Up 43 hours (health: starting)   0.0.0.0:5053->53/udp                                                                          cloudflare-suffix
4b2c2b900675        pihole/pihole:latest           "/s6-init"               6 days ago          Up 6 days (healthy)              0.0.0.0:80->80/tcp, 53/tcp, 0.0.0.0:53->53/udp, 0.0.0.0:443->443/tcp, 0.0.0.0:32768->67/udp   pihole
suffix:~ admin$ docker version
Client: Docker Engine - Community
 Version:           18.09.2
 API version:       1.39
 Go version:        go1.10.8
 Git commit:        6247962
 Built:             Sun Feb 10 04:12:39 2019
 OS/Arch:           darwin/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          18.09.2
  API version:      1.39 (minimum version 1.12)
  Go version:       go1.10.6
  Git commit:       6247962
  Built:            Sun Feb 10 04:13:06 2019
  OS/Arch:          linux/amd64
  Experimental:     false
suffix:~ admin$ docker inspect 757b6cb36397
[
    {
        "Id": "757b6cb36397b9d3413987be6ea2c9a6e9f5921a4cd02279fb8a850de8ecdab8",
        "Created": "2019-04-01T19:11:44.225202214Z",
        "Path": "/bin/sh",
        "Args": [
            "-c",
            "/etc/unbound/entrypoint.sh"
        ],
        "State": {
            "Status": "running",
            "Running": true,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": 33207,
            "ExitCode": 0,
            "Error": "",
            "StartedAt": "2019-04-01T19:11:44.967748945Z",
            "FinishedAt": "0001-01-01T00:00:00Z",
            "Health": {
                "Status": "unhealthy",
                "FailingStreak": 0,
                "Log": []
            }
        },
        "Image": "sha256:3abdb3b92fc19d0c0ad835a3e64fac6ed8d19871e035b3aca2254ca15ce2b630",
        "ResolvConfPath": "/var/lib/docker/containers/757b6cb36397b9d3413987be6ea2c9a6e9f5921a4cd02279fb8a850de8ecdab8/resolv.conf",
        "HostnamePath": "/var/lib/docker/containers/757b6cb36397b9d3413987be6ea2c9a6e9f5921a4cd02279fb8a850de8ecdab8/hostname",
        "HostsPath": "/var/lib/docker/containers/757b6cb36397b9d3413987be6ea2c9a6e9f5921a4cd02279fb8a850de8ecdab8/hosts",
        "LogPath": "/var/lib/docker/containers/757b6cb36397b9d3413987be6ea2c9a6e9f5921a4cd02279fb8a850de8ecdab8/757b6cb36397b9d3413987be6ea2c9a6e9f5921a4cd02279fb8a850de8ecdab8-json.log",
        "Name": "/cloudflare-suffix",
        "RestartCount": 0,
        "Driver": "overlay2",
        "Platform": "linux",
        "MountLabel": "",
        "ProcessLabel": "",
        "AppArmorProfile": "",
        "ExecIDs": null,
        "HostConfig": {
            "Binds": null,
            "ContainerIDFile": "",
            "LogConfig": {
                "Type": "json-file",
                "Config": {}
            },
            "NetworkMode": "default",
            "PortBindings": {
                "53/udp": [
                    {
                        "HostIp": "",
                        "HostPort": "5053"
                    }
                ]
            },
            "RestartPolicy": {
                "Name": "no",
                "MaximumRetryCount": 0
            },
            "AutoRemove": false,
            "VolumeDriver": "",
            "VolumesFrom": null,
            "CapAdd": null,
            "CapDrop": null,
            "Dns": [],
            "DnsOptions": [],
            "DnsSearch": [],
            "ExtraHosts": null,
            "GroupAdd": null,
            "IpcMode": "shareable",
            "Cgroup": "",
            "Links": null,
            "OomScoreAdj": 0,
            "PidMode": "",
            "Privileged": false,
            "PublishAllPorts": false,
            "ReadonlyRootfs": false,
            "SecurityOpt": null,
            "UTSMode": "",
            "UsernsMode": "",
            "ShmSize": 67108864,
            "Runtime": "runc",
            "ConsoleSize": [
                0,
                0
            ],
            "Isolation": "",
            "CpuShares": 0,
            "Memory": 0,
            "NanoCpus": 0,
            "CgroupParent": "",
            "BlkioWeight": 0,
            "BlkioWeightDevice": [],
            "BlkioDeviceReadBps": null,
            "BlkioDeviceWriteBps": null,
            "BlkioDeviceReadIOps": null,
            "BlkioDeviceWriteIOps": null,
            "CpuPeriod": 0,
            "CpuQuota": 0,
            "CpuRealtimePeriod": 0,
            "CpuRealtimeRuntime": 0,
            "CpusetCpus": "",
            "CpusetMems": "",
            "Devices": [],
            "DeviceCgroupRules": null,
            "DiskQuota": 0,
            "KernelMemory": 0,
            "MemoryReservation": 0,
            "MemorySwap": 0,
            "MemorySwappiness": null,
            "OomKillDisable": false,
            "PidsLimit": 0,
            "Ulimits": null,
            "CpuCount": 0,
            "CpuPercent": 0,
            "IOMaximumIOps": 0,
            "IOMaximumBandwidth": 0,
            "MaskedPaths": [
                "/proc/asound",
                "/proc/acpi",
                "/proc/kcore",
                "/proc/keys",
                "/proc/latency_stats",
                "/proc/timer_list",
                "/proc/timer_stats",
                "/proc/sched_debug",
                "/proc/scsi",
                "/sys/firmware"
            ],
            "ReadonlyPaths": [
                "/proc/bus",
                "/proc/fs",
                "/proc/irq",
                "/proc/sys",
                "/proc/sysrq-trigger"
            ]
        },
        "GraphDriver": {
            "Data": {
                "LowerDir": "/var/lib/docker/overlay2/1ab19f646797b1fb7c2073bac7aef095adba8c1089174419ad3d8872a5645510-init/diff:/var/lib/docker/overlay2/e646f69de0bcdeb4480c458a031dddc319e5614b2021ea6875dcc7158b85eaf3/diff:/var/lib/docker/overlay2/2dd1ffcbc9102ab9c6db7876076cae261b70cf5d273a1efef39de315c8c461c2/diff:/var/lib/docker/overlay2/3e0214d0cf23a9cc75595651dc17a58be041bc5f462b1fb510cdce7b585e5232/diff:/var/lib/docker/overlay2/1570a4b8101ee5de4051f8321ee64012b4975d429a20f0682b0493a48e1f0322/diff",
                "MergedDir": "/var/lib/docker/overlay2/1ab19f646797b1fb7c2073bac7aef095adba8c1089174419ad3d8872a5645510/merged",
                "UpperDir": "/var/lib/docker/overlay2/1ab19f646797b1fb7c2073bac7aef095adba8c1089174419ad3d8872a5645510/diff",
                "WorkDir": "/var/lib/docker/overlay2/1ab19f646797b1fb7c2073bac7aef095adba8c1089174419ad3d8872a5645510/work"
            },
            "Name": "overlay2"
        },
        "Mounts": [],
        "Config": {
            "Hostname": "757b6cb36397",
            "Domainname": "",
            "User": "root",
            "AttachStdin": false,
            "AttachStdout": true,
            "AttachStderr": true,
            "ExposedPorts": {
                "53/udp": {}
            },
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PROVIDER=quad9",
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "VERBOSITY=1",
                "VERBOSITY_DETAILS=0",
                "BLOCK_MALICIOUS=on",
                "LISTENINGPORT=53"
            ],
            "Cmd": null,
            "Healthcheck": {
                "Test": [
                    "CMD-SHELL",
                    "LISTENINGPORT=${LISTENINGPORT:-53}; [ -z $(nslookup duckduckgo.com 127.0.0.1 -port=$LISTENING_PORT -timeout=1 | grep \"no servers could be reached\") ] || exit 1"
                ],
                "Interval": 300000000000,
                "Timeout": 15000000000,
                "StartPeriod": 5000000000,
                "Retries": 1
            },
            "ArgsEscaped": true,
            "Image": "qmcgaw/cloudflare-dns-server",
            "Volumes": null,
            "WorkingDir": "",
            "Entrypoint": [
                "/bin/sh",
                "-c",
                "/etc/unbound/entrypoint.sh"
            ],
            "OnBuild": null,
            "Labels": {
                "cpu-usage": "Low",
                "image-size": "17MB",
                "maintainer": "[email protected]",
                "org.label-schema.build-date": "2019-03-30T06:24:39Z",
                "org.label-schema.docker.cmd": "docker run -d -p 53:53/udp qmcgaw/cloudflare-dns-server",
                "org.label-schema.docker.cmd.devel": "docker run -it --rm -p 53:53/udp -e VERBOSITY=3 -e VERBOSITY_DETAILS=3 -e BLOCK_MALICIOUS=off qmcgaw/cloudflare-dns-server",
                "org.label-schema.docker.params": "VERBOSITY=from 0 (no log) to 5 (full debug log) and defaults to 1,VERBOSITY_DETAILS=0 to 4 and defaults to 0 (higher means more details),BLOCK_MALICIOUS='on' or 'off' and defaults to 'on' (note that it consumes about 50MB of additional RAM),LISTENING_PORT=1 to 65535 for internal Unbound listening port,PROVIDER=CLOUDFLARE or GOOGLE or QUAD9 or QUADRANT or CLEANBROWSING",
                "org.label-schema.schema-version": "1.0.0-rc1",
                "org.label-schema.url": "https://github.com/qdm12/cloudflare-dns-server",
                "org.label-schema.vcs-description": "Runs a local DNS server connected to Cloudflare DNS server 1.1.1.1 over TLS (and more)",
                "org.label-schema.vcs-ref": "98fc026",
                "org.label-schema.vcs-url": "https://github.com/qdm12/cloudflare-dns-server",
                "org.label-schema.vcs-usage": "https://github.com/qdm12/cloudflare-dns-server/blob/master/README.md#setup",
                "ram-usage": "13.2MB to 70MB"
            }
        },
        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "27064633baca78f8a84ce3aeb8ac11e6be2590c1d97714e298eff588168f1a94",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {
                "53/udp": [
                    {
                        "HostIp": "0.0.0.0",
                        "HostPort": "5053"
                    }
                ]
            },
            "SandboxKey": "/var/run/docker/netns/27064633baca",
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "eab6194dd92f99eef1259b5c969dd285135d05b238cd62176045906c76f9af0b",
            "Gateway": "172.17.0.1",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "IPAddress": "172.17.0.3",
            "IPPrefixLen": 16,
            "IPv6Gateway": "",
            "MacAddress": "02:42:ac:11:00:03",
            "Networks": {
                "bridge": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": null,
                    "NetworkID": "59cdd7d69340b2139e39e809bcbb212ffeb5555b3bbc71e7c572d6a20564ad3c",
                    "EndpointID": "eab6194dd92f99eef1259b5c969dd285135d05b238cd62176045906c76f9af0b",
                    "Gateway": "172.17.0.1",
                    "IPAddress": "172.17.0.3",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "02:42:ac:11:00:03",
                    "DriverOpts": null
                }
            }
        }
    }
]
suffix:~ admin$

Here is the status of this container

suffix:~ admin$ docker ps
CONTAINER ID        IMAGE                          COMMAND                  CREATED             STATUS                           PORTS                                                                                         NAMES
757b6cb36397        qmcgaw/cloudflare-dns-server   "/bin/sh -c /etc/unb…"   43 hours ago        Up 43 hours (health: starting)   0.0.0.0:5053->53/udp                                                                          cloudflare-suffix
4b2c2b900675        pihole/pihole:latest           "/s6-init"               6 days ago          Up 6 days (healthy)              0.0.0.0:80->80/tcp, 53/tcp, 0.0.0.0:53->53/udp, 0.0.0.0:443->443/tcp, 0.0.0.0:32768->67/udp   pihole
suffix:~ admin$

The container works but I am getting this health starting for 43 hours now. Happy to share how my two piholes interact with each other if that is necessary

Running as service

Hello,

I'm trying to setup this dns server inside my swarm cluster, it does work, but keeps forever in "starting" state.

Health checks don't work in this mode?

Health checking is KO

Hi all,

Very awesome work ! Thanks ;)

I noticed that the container could not go to healthy => remains on starting
72bd9443b31f qmcgaw/cloudflare-dns-server "/bin/sh -c /unbound…" 4 minutes ago Up 4 minutes (health: starting) Dns

Ping of duckduckgo inside container is KO

The dns works very well

$ dig @localhost duckduckgo.com

; <<>> DiG 9.11.5-P4-5.1-Debian <<>> @localhost duckduckgo.com
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3738
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;duckduckgo.com.                        IN      A

;; ANSWER SECTION:
duckduckgo.com.         3532    IN      A       46.51.179.90
duckduckgo.com.         3532    IN      A       79.125.105.113
duckduckgo.com.         3532    IN      A       176.34.155.23

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: mar. janv. 14 19:23:02 CET 2020
;; MSG SIZE  rcvd: 91

This is my docker-compose

cloudflare-dns-server:
   environment:
     - VERBOSITY=1
     - VERBOSITY_DETAILS=0
     - PROVIDERS=cloudflare,quad9
     - BLOCK_NSA=on
  image: qmcgaw/cloudflare-dns-server
  container_name: Dns
  network_mode: host

dns resolve error

I had problem today with resolving "ads.google.com".

I figured it out, that --env BLOCK_MALICIOUS=off solve this.

unbound config error when PRIVATE_ADDRESS is empty

With the new go version, it seems like unbound configuration is broken if PRIVATE_ADDRESS is set to empty.

cfdns    | Private addresses: 
cfdns    |  |--
cfdns    | Check Unbound: enabled
cfdns    | 2020-04-26T05:18:15.221Z     INFO    using DNS address 1.1.1.1 internally
cfdns    | 2020-04-26T05:18:15.221Z     INFO    downloading root hints from https://raw.githubusercontent.com/qdm12/files/master/named.root.updated
cfdns    | 2020-04-26T05:18:15.496Z     INFO    downloading root key from https://raw.githubusercontent.com/qdm12/files/master/root.key.updated
cfdns    | 2020-04-26T05:18:15.555Z     INFO    generating Unbound configuration
cfdns    | 2020-04-26T05:18:16.689Z     INFO    129837 hostnames blocked overall
cfdns    | 2020-04-26T05:18:16.689Z     INFO    265482 IP addresses blocked overall
cfdns    | 2020-04-26T05:18:16.998Z     INFO    starting unbound
cfdns    | 2020-04-26T05:18:16.998Z     INFO    using DNS address 127.0.0.1 internally
cfdns    | 2020-04-26T05:18:16.999Z     WARN    could not resolve github.com (try 1 of 10): lookup github.com on 192.168.1.1:53: read udp 127.0.0.1:53895->127.0.0.1:53: read: connection refused
cfdns    | 2020-04-26T05:18:17.151Z     INFO    unbound: /unbound/unbound.conf:129870: error: unknown keyword '1.0.1.4'
cfdns    | 2020-04-26T05:18:17.340Z     INFO    unbound: read /unbound/unbound.conf failed: 1 errors in configuration file
cfdns    | 2020-04-26T05:18:17.340Z     INFO    unbound: [1587878297] unbound[12:0] fatal error: Could not read config file: /unbound/unbound.conf. Maybe try unbound -dd, it stays on the commandline to see more errors, or unbound-checkconf
cfdns    | 2020-04-26T05:18:17.502Z     WARN    could not resolve github.com (try 2 of 10): lookup github.com on 192.168.1.1:53: read udp 127.0.0.1:41835->127.0.0.1:53: read: connection refused

It looks like the error is due to the handling of "" on this line:
https://github.com/qdm12/cloudflare-dns-server/blob/080a1c62a3ed64b6114d6085c74d9eca31357502/internal/params/dns.go#L42

An empty string "" is appended to privateAddresses when s is "" causing unbound configuration to fail.

Whitelist for ads?

Hi. I'm wondering if unlocking a domain also unlocks ads, or if there is any option to enlist whitelist for ads.

The domain that matters is investing.com which refuses to show the page normally without accepting ads or pay for premium account.

At first I thought there must be yet another domain for ads to unlock, but the reply from a guy at the company suggests, while he does not seem know what is DNS, that there's no other domain for ads.

Best,
WonCheol

Multi-Arch Docker Hub image?

Howdy,

I would love an ARM based image in Docker Hub as a tag. :)

surveillance list

Is this just a list of government sites?

I was only alerted to this as my wife is a lawyer and needs to access these types of sites regularly. (not a big deal to disable)

I am just curious what the thought process was behind the list?

error: can't bind socket: permission denied.

Hi, I am testing your build from scratch on a synology, and here is what I'm seeing. I'm a bit confused because from your most recent changes, it sounds like running as a non-root-user shouldn't be a problem, but clearly it is. Can you help?

docker run -it --rm --name dns -p 53:53/udp -e VERBOSITY=5 -e VERBOSITY_DETAILS=4 -e BLOCK_MALICIOUS=off qmcgaw/cloudflare-dns-server
Unable to find image 'qmcgaw/cloudflare-dns-server:latest' locally
latest: Pulling from qmcgaw/cloudflare-dns-server
4fe2ade4980c: Already exists 
0cd970152cc6: Pull complete 
0cd8ed03c739: Pull complete 
857cf1d27e1d: Pull complete 
ba942c51bb57: Pull complete 
013c5f68402b: Pull complete 
0b624eaa3c30: Pull complete 
283041182f9d: Pull complete 
970357afc184: Pull complete 
Digest: sha256:88923bee0befbb9fadd00a67923dd3f9999196d600c0fa6acc8147b28c3ffddd
Status: Downloaded newer image for qmcgaw/cloudflare-dns-server:latest
 =========================================
 =========================================
 === CLOUDFLARE DNS OVER TLS CONTAINER ===
 =========================================
 =========================================
 == by github.com/qdm12 - Quentin McGaw ==

Running as nonrootuser
Unbound version: 1.7.3
Unbound listening UDP port: 53
Verbosity level set to 5 on 5
Verbosity details level set to 4 on 4
Malicious hostnames and ips blocking is off
[1542342706] unbound[27:0] notice: Start of unbound 1.7.3.
[1542342706] unbound[27:0] debug: creating udp4 socket 0.0.0.0 53
[1542342706] unbound[27:0] error: can't bind socket: Permission denied for 0.0.0.0 port 53 (len 16)
[1542342706] unbound[27:0] fatal error: could not open ports

 =========================================
 Unbound exit with status 1
 =========================================

issue with cloudflare-dns-server in mac (docker)

I spoke too soon last time I opened my last issue. Let me describe my setup: I have two hosts

192.168.1.2 (pihole-brutus) running pihole and cloudflare-dns. The upstream DNS servers for this host are 127.0.0.1#53 and 192.168.1.3#5053

192.168.1.3 (pihole-suffix) running pihole and cloudflare-dns. The upstream DNS servers for this host are 127.0.0.1#53 and 192.168.1.2#5053

If I point one of my local machines to 192.168.1.2 as its resolver the name resolution works. I can specify individually either one of their DNS upstreams in pihole (or both at the same time) and name resolution works.

If I point one of my local machines to 192.168.1.3 as its resolver the name resolution doesn't work. If I modify the upstream DNS servers and I used anything other than localhost:5053 as the upstream DNS for this pihole the name resolution works.

suffix:~ admin$ docker ps
CONTAINER ID        IMAGE                          COMMAND                  CREATED             STATUS                    PORTS                                                                                      NAMES
ce8c47910ae1        qmcgaw/cloudflare-dns-server   "/bin/sh -c /etc/unb…"   11 minutes ago      Up 11 minutes (healthy)   0.0.0.0:5053->53/udp                                                                       cloudflare-suffix
ce1c373db763        pihole/pihole:latest           "/s6-init"               13 minutes ago      Up 13 minutes (healthy)   0.0.0.0:53->53/tcp, 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp, 0.0.0.0:53->53/udp, 67/udp   pihole-suffix

docker logs for 192.168.1.3

suffix:~ admin$ docker logs ce8c47910ae1
 =========================================
 =========================================
 === CLOUDFLARE DNS OVER TLS CONTAINER ===
 =========================================
 =========================================
 == by github.com/qdm12 - Quentin McGaw ==

Running as root
Unbound version: 1.8.3
Unbound DNS server: google
Unbound listening UDP port: 53
Verbosity level set to 1 on 5
Verbosity details level set to 0 on 4
Malicious hostnames and ips blocking is on
147173 malicious hostnames and 16021 malicious IP addresses blacklisted
[1554347234] unbound[35:0] notice: init module 0: validator
[1554347234] unbound[35:0] notice: init module 1: iterator
[1554347234] unbound[35:0] info: start of service (unbound 1.8.3).
[1554347532] unbound[35:1] info: generate keytag query _ta-4a5c-4f66. NULL IN
suffix:~ admin$

I almost forgot to mention 192.168.1.3 is a a mac mini running docker for OSX while 192.168.1.2 is Synology NAS running docker.

Now here is the docker inspect output

suffix:~ admin$ docker inspect cloudflare-suffix
[
    {
        "Id": "ce8c47910ae14a97bcc625e7c677e2fc92c8c8788a3fb551efc2a853940ec4e3",
        "Created": "2019-04-04T03:07:11.340120062Z",
        "Path": "/bin/sh",
        "Args": [
            "-c",
            "/etc/unbound/entrypoint.sh"
        ],
        "State": {
            "Status": "running",
            "Running": true,
            "Paused": false,
            "Restarting": false,
            "OOMKilled": false,
            "Dead": false,
            "Pid": 5091,
            "ExitCode": 0,
            "Error": "",
            "StartedAt": "2019-04-04T03:07:12.251347814Z",
            "FinishedAt": "0001-01-01T00:00:00Z",
            "Health": {
                "Status": "healthy",
                "FailingStreak": 0,
                "Log": [
                    {
                        "Start": "2019-04-04T03:12:12.034163831Z",
                        "End": "2019-04-04T03:12:12.85962567Z",
                        "ExitCode": 0,
                        "Output": ""
                    },
                    {
                        "Start": "2019-04-04T03:17:12.651246179Z",
                        "End": "2019-04-04T03:17:12.76505059Z",
                        "ExitCode": 0,
                        "Output": ""
                    },
                    {
                        "Start": "2019-04-04T03:22:12.562023379Z",
                        "End": "2019-04-04T03:22:12.682359992Z",
                        "ExitCode": 0,
                        "Output": ""
                    },
                    {
                        "Start": "2019-04-04T03:27:12.495949075Z",
                        "End": "2019-04-04T03:27:12.595405771Z",
                        "ExitCode": 0,
                        "Output": ""
                    }
                ]
            }
        },
        "Image": "sha256:074deaa4492620f377df84b174042365e21b1d558df49498826722e0b3164b6b",
        "ResolvConfPath": "/var/lib/docker/containers/ce8c47910ae14a97bcc625e7c677e2fc92c8c8788a3fb551efc2a853940ec4e3/resolv.conf",
        "HostnamePath": "/var/lib/docker/containers/ce8c47910ae14a97bcc625e7c677e2fc92c8c8788a3fb551efc2a853940ec4e3/hostname",
        "HostsPath": "/var/lib/docker/containers/ce8c47910ae14a97bcc625e7c677e2fc92c8c8788a3fb551efc2a853940ec4e3/hosts",
        "LogPath": "/var/lib/docker/containers/ce8c47910ae14a97bcc625e7c677e2fc92c8c8788a3fb551efc2a853940ec4e3/ce8c47910ae14a97bcc625e7c677e2fc92c8c8788a3fb551efc2a853940ec4e3-json.log",
        "Name": "/cloudflare-suffix",
        "RestartCount": 0,
        "Driver": "overlay2",
        "Platform": "linux",
        "MountLabel": "",
        "ProcessLabel": "",
        "AppArmorProfile": "",
        "ExecIDs": null,
        "HostConfig": {
            "Binds": null,
            "ContainerIDFile": "",
            "LogConfig": {
                "Type": "json-file",
                "Config": {}
            },
            "NetworkMode": "default",
            "PortBindings": {
                "53/udp": [
                    {
                        "HostIp": "",
                        "HostPort": "5053"
                    }
                ]
            },
            "RestartPolicy": {
                "Name": "no",
                "MaximumRetryCount": 0
            },
            "AutoRemove": false,
            "VolumeDriver": "",
            "VolumesFrom": null,
            "CapAdd": null,
            "CapDrop": null,
            "Dns": [],
            "DnsOptions": [],
            "DnsSearch": [],
            "ExtraHosts": null,
            "GroupAdd": null,
            "IpcMode": "shareable",
            "Cgroup": "",
            "Links": null,
            "OomScoreAdj": 0,
            "PidMode": "",
            "Privileged": false,
            "PublishAllPorts": false,
            "ReadonlyRootfs": false,
            "SecurityOpt": null,
            "UTSMode": "",
            "UsernsMode": "",
            "ShmSize": 67108864,
            "Runtime": "runc",
            "ConsoleSize": [
                0,
                0
            ],
            "Isolation": "",
            "CpuShares": 0,
            "Memory": 0,
            "NanoCpus": 0,
            "CgroupParent": "",
            "BlkioWeight": 0,
            "BlkioWeightDevice": [],
            "BlkioDeviceReadBps": null,
            "BlkioDeviceWriteBps": null,
            "BlkioDeviceReadIOps": null,
            "BlkioDeviceWriteIOps": null,
            "CpuPeriod": 0,
            "CpuQuota": 0,
            "CpuRealtimePeriod": 0,
            "CpuRealtimeRuntime": 0,
            "CpusetCpus": "",
            "CpusetMems": "",
            "Devices": [],
            "DeviceCgroupRules": null,
            "DiskQuota": 0,
            "KernelMemory": 0,
            "MemoryReservation": 0,
            "MemorySwap": 0,
            "MemorySwappiness": null,
            "OomKillDisable": false,
            "PidsLimit": 0,
            "Ulimits": null,
            "CpuCount": 0,
            "CpuPercent": 0,
            "IOMaximumIOps": 0,
            "IOMaximumBandwidth": 0,
            "MaskedPaths": [
                "/proc/asound",
                "/proc/acpi",
                "/proc/kcore",
                "/proc/keys",
                "/proc/latency_stats",
                "/proc/timer_list",
                "/proc/timer_stats",
                "/proc/sched_debug",
                "/proc/scsi",
                "/sys/firmware"
            ],
            "ReadonlyPaths": [
                "/proc/bus",
                "/proc/fs",
                "/proc/irq",
                "/proc/sys",
                "/proc/sysrq-trigger"
            ]
        },
        "GraphDriver": {
            "Data": {
                "LowerDir": "/var/lib/docker/overlay2/4ab249cbbc0a1648d8dec74313fb45d9cea97f4202f1851b9304979b7d55f5f4-init/diff:/var/lib/docker/overlay2/3987f2517fb0b8091bf9025c19a72320918ebb39faa42df5002eabaadd00500b/diff:/var/lib/docker/overlay2/33b5039a9653bfd714652763b6a01e28e335603a44059cd6541b5995a8a5f218/diff:/var/lib/docker/overlay2/3ab1aeeb147eec6a1f4b114d7500e0e9b75cb2167f5cb208f70f61279b10a51b/diff:/var/lib/docker/overlay2/1570a4b8101ee5de4051f8321ee64012b4975d429a20f0682b0493a48e1f0322/diff",
                "MergedDir": "/var/lib/docker/overlay2/4ab249cbbc0a1648d8dec74313fb45d9cea97f4202f1851b9304979b7d55f5f4/merged",
                "UpperDir": "/var/lib/docker/overlay2/4ab249cbbc0a1648d8dec74313fb45d9cea97f4202f1851b9304979b7d55f5f4/diff",
                "WorkDir": "/var/lib/docker/overlay2/4ab249cbbc0a1648d8dec74313fb45d9cea97f4202f1851b9304979b7d55f5f4/work"
            },
            "Name": "overlay2"
        },
        "Mounts": [],
        "Config": {
            "Hostname": "a7680fbfe37a",
            "Domainname": "",
            "User": "root",
            "AttachStdin": false,
            "AttachStdout": true,
            "AttachStderr": true,
            "ExposedPorts": {
                "53/udp": {}
            },
            "Tty": false,
            "OpenStdin": false,
            "StdinOnce": false,
            "Env": [
                "PROVIDER=google",
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "VERBOSITY=1",
                "VERBOSITY_DETAILS=0",
                "BLOCK_MALICIOUS=on",
                "LISTENINGPORT=53"
            ],
            "Cmd": null,
            "Healthcheck": {
                "Test": [
                    "CMD-SHELL",
                    "LISTENINGPORT=${LISTENINGPORT:-53}; [ -z $(nslookup duckduckgo.com 127.0.0.1 -port=$LISTENING_PORT -timeout=1 | grep \"no servers could be reached\") ] || exit 1"
                ],
                "Interval": 300000000000,
                "Timeout": 15000000000,
                "StartPeriod": 5000000000,
                "Retries": 1
            },
            "ArgsEscaped": true,
            "Image": "qmcgaw/cloudflare-dns-server",
            "Volumes": null,
            "WorkingDir": "",
            "Entrypoint": [
                "/bin/sh",
                "-c",
                "/etc/unbound/entrypoint.sh"
            ],
            "OnBuild": null,
            "Labels": {
                "cpu-usage": "Low",
                "image-size": "17MB",
                "maintainer": "[email protected]",
                "org.label-schema.build-date": "2019-04-02T06:27:35Z",
                "org.label-schema.docker.cmd": "docker run -d -p 53:53/udp qmcgaw/cloudflare-dns-server",
                "org.label-schema.docker.cmd.devel": "docker run -it --rm -p 53:53/udp -e VERBOSITY=3 -e VERBOSITY_DETAILS=3 -e BLOCK_MALICIOUS=off qmcgaw/cloudflare-dns-server",
                "org.label-schema.docker.params": "VERBOSITY=from 0 (no log) to 5 (full debug log) and defaults to 1,VERBOSITY_DETAILS=0 to 4 and defaults to 0 (higher means more details),BLOCK_MALICIOUS='on' or 'off' and defaults to 'on' (note that it consumes about 50MB of additional RAM),LISTENING_PORT=1 to 65535 for internal Unbound listening port,PROVIDER=CLOUDFLARE or GOOGLE or QUAD9 or QUADRANT or CLEANBROWSING",
                "org.label-schema.schema-version": "1.0.0-rc1",
                "org.label-schema.url": "https://github.com/qdm12/cloudflare-dns-server",
                "org.label-schema.vcs-description": "Runs a local DNS server connected to Cloudflare DNS server 1.1.1.1 over TLS (and more)",
                "org.label-schema.vcs-ref": "98fc026",
                "org.label-schema.vcs-url": "https://github.com/qdm12/cloudflare-dns-server",
                "org.label-schema.vcs-usage": "https://github.com/qdm12/cloudflare-dns-server/blob/master/README.md#setup",
                "ram-usage": "13.2MB to 70MB"
            }
        },
        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "86211990d33959b1181f3c662851b32507eacaf26d1ba0d0a35336889235dddf",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {
                "53/udp": [
                    {
                        "HostIp": "0.0.0.0",
                        "HostPort": "5053"
                    }
                ]
            },
            "SandboxKey": "/var/run/docker/netns/86211990d339",
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "bf16c767ca6eb97dceaf0aa685c4ce4e69237dfe917ab774c20378f9152ecbdb",
            "Gateway": "172.17.0.1",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "IPAddress": "172.17.0.3",
            "IPPrefixLen": 16,
            "IPv6Gateway": "",
            "MacAddress": "02:42:ac:11:00:03",
            "Networks": {
                "bridge": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": [],
                    "NetworkID": "25e5cea229aed6ccfaeae322475a357279337582a3b0149504cfb9176eb1c7e0",
                    "EndpointID": "bf16c767ca6eb97dceaf0aa685c4ce4e69237dfe917ab774c20378f9152ecbdb",
                    "Gateway": "172.17.0.1",
                    "IPAddress": "172.17.0.3",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "02:42:ac:11:00:03",
                    "DriverOpts": null
                }
            }
        }
    }
]

The healthcheck for the container passes

suffix:~ admin$ docker exec cloudflare-suffix nslookup duckduckgo.com 127.0.0.1 -port=53 -timeout=1
Server:         127.0.0.1
Address:        127.0.0.1#53

Non-authoritative answer:
Name:   duckduckgo.com
Address: 23.21.193.169
Name:   duckduckgo.com
Address: 107.20.240.232
Name:   duckduckgo.com
Address: 184.72.104.138

suffix:~ admin$

It is almost like the pihole instance in OSX can't communicate with cloudflare-dns-server over port 5053 right on the same host. Here is the output of netstat for UDP port 5053

bash-3.2# netstat -at | grep 5053
udp4       0      0  *.5053                 *.*

Really appreciate your support. I spent at least 3 hours trying to debug this problem. Happy to arrange whatever access or whatever information you need

unable to resolve domain

Hi Quentin,
any idea why the upstream server is unable to resolve windelwissen.de?

Test with upstream server

[axel@axel-pc ~]$ dig windelwissen.de @192.168.2.6

; <<>> DiG 9.16.10 <<>> windelwissen.de @192.168.2.6
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4853
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;windelwissen.de.               IN      A

;; Query time: 303 msec
;; SERVER: 192.168.2.6#53(192.168.2.6)
;; WHEN: Fr Jan 29 15:58:01 CET 2021
;; MSG SIZE  rcvd: 44

Test with quad9 directly

[axel@axel-pc ~]$ dig windelwissen.de @8.8.8.8

; <<>> DiG 9.16.10 <<>> windelwissen.de @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3276
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;windelwissen.de.               IN      A

;; ANSWER SECTION:
windelwissen.de.        299     IN      A       23.227.38.65

;; Query time: 26 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fr Jan 29 15:58:12 CET 2021
;; MSG SIZE  rcvd: 60

Unsigned issue when building trust

I was just checking the logs of the docker container and it is spammed with

DS got unsigned CNAME answer from 1.0.0.1 and 1.0.0.1 for DS is-cf.cloudflareresolve.com. while building chain of trust

Then later on the same happens for 1.1.1.1

S got unsigned CNAME answer from 1.1.1.1 and 1.0.0.1 for DS is-cf.cloudflareresolve.com. while building chain of trust

Any idea on how to resolve this? I assume it is leading to DoT not working.

Add DNSSEC support for `v2.0.0-beta`

See https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en

NSEC and NSEC3 records support
Cache RRSIG (and others?) for their validity period
Renew keys when they expire

Useful resources:

https://pi-hole.net/blog/2021/12/12/understanding-dnssec-validation-using-pi-holes-query-log/#page-content
https://www.youtube.com/watch?v=jOeyDFuKqvI
https://www.ietf.org/rfc/rfc4033.txt
DNSSEC Series #6. DNSSEC Record Types, Keys, Signatures, and NSEC, Part 2: https://www.youtube.com/watch?v=MheHMWCOTvE

Double check with https://wander.science/projects/dns/dnssec-resolver-test/

github.com resolving issue in the current go-based build

If root privilege is not given, container throws following log and then crashes.

cfdns      | =========================================
cfdns      | ========= DNS over TLS container ========
cfdns      | =========================================
cfdns      | =========================================
cfdns      | === Made with ❤  by github.com/qdm12 ====
cfdns      | =========================================
cfdns      |
cfdns      | Running version latest built on 2020-02-09T13:47:39Z (commit 3ad21be)
cfdns      |
cfdns      | 📣  Total rewrite in Go with many new features
cfdns      |
cfdns      | 🔧  Need help? https://github.com/qdm12/cloudflare-dns-server/issues/new
cfdns      | 💻  Email? [email protected]
cfdns      | ☕  Slack? Join from the Slack button on Github
cfdns      | 💸  Help me? https://github.com/sponsors/qdm12
cfdns      | 2020-02-11T14:21:48.380Z   INFO    Unbound version: 1.9.6
cfdns      | 2020-02-11T14:21:48.380Z   INFO    Settings summary:
cfdns      | DNS over TLS provider:
cfdns      | |--cloudflare
cfdns      | |--quad9
cfdns      | Listening port: 8053
cfdns      | Caching: disabed
cfdns      | Verbosity level: 1/5
cfdns      | Verbosity details level: 0/4
cfdns      | Validation log level: 0/2
cfdns      | Block malicious: disabed
cfdns      | Block surveillance: disabed
cfdns      | Block ads: disabed
cfdns      | Blocked hostnames:
cfdns      | Blocked IP addresses:
cfdns      | Allowed hostnames:
cfdns      | Private addresses:
cfdns      |  |--127.0.0.1/8
cfdns      |  |--10.0.0.0/8
cfdns      |  |--172.16.0.0/12
cfdns      |  |--192.168.0.0/16
cfdns      |  |--169.254.0.0/16
cfdns      |  |--::1/128
cfdns      |  |--fc00::/7
cfdns      |  |--fe80::/10
cfdns      |  |--::ffff:0:0/96
cfdns      | 2020-02-11T14:21:48.380Z   INFO    using DNS address 1.1.1.1 internally
cfdns      | 2020-02-11T14:21:48.380Z   INFO    downloading root hints from https://raw.githubusercontent.com/qdm12/files/master/named.root.updated
cfdns      | 2020-02-11T14:21:48.680Z   ERROR   cannot write to file "/unbound/root.hints": open /unbound/root.hints: permission denied

If root privilege is given, container crashes and keep restarting after 10 tries resolving github.com

cfdns      | =========================================
cfdns      | ========= DNS over TLS container ========
cfdns      | =========================================
cfdns      | =========================================
cfdns      | === Made with ❤  by github.com/qdm12 ====
cfdns      | =========================================
cfdns      |
cfdns      | Running version latest built on 2020-02-09T13:47:39Z (commit 3ad21be)
cfdns      |
cfdns      | 📣  Total rewrite in Go with many new features
cfdns      |
cfdns      | 🔧  Need help? https://github.com/qdm12/cloudflare-dns-server/issues/new
cfdns      | 💻  Email? [email protected]
cfdns      | ☕  Slack? Join from the Slack button on Github
cfdns      | 💸  Help me? https://github.com/sponsors/qdm12
cfdns      | 2020-02-11T14:25:44.910Z   INFO    Unbound version: 1.9.6
cfdns      | 2020-02-11T14:25:44.911Z   INFO    Settings summary:
cfdns      | DNS over TLS provider:
cfdns      | |--cloudflare
cfdns      | |--quad9
cfdns      | Listening port: 8053
cfdns      | Caching: disabed
cfdns      | Verbosity level: 1/5
cfdns      | Verbosity details level: 0/4
cfdns      | Validation log level: 0/2
cfdns      | Block malicious: disabed
cfdns      | Block surveillance: disabed
cfdns      | Block ads: disabed
cfdns      | Blocked hostnames:
cfdns      | Blocked IP addresses:
cfdns      | Allowed hostnames:
cfdns      | Private addresses:
cfdns      |  |--127.0.0.1/8
cfdns      |  |--10.0.0.0/8
cfdns      |  |--172.16.0.0/12
cfdns      |  |--192.168.0.0/16
cfdns      |  |--169.254.0.0/16
cfdns      |  |--::1/128
cfdns      |  |--fc00::/7
cfdns      |  |--fe80::/10
cfdns      |  |--::ffff:0:0/96
cfdns      | 2020-02-11T14:25:44.911Z   INFO    using DNS address 1.1.1.1 internally
cfdns      | 2020-02-11T14:25:44.911Z   INFO    downloading root hints from https://raw.githubusercontent.com/qdm12/files/master/named.root.updated
cfdns      | 2020-02-11T14:25:45.284Z   INFO    downloading root key from https://raw.githubusercontent.com/qdm12/files/master/root.key.updated
cfdns      | 2020-02-11T14:25:45.317Z   INFO    generating Unbound configuration
cfdns      | 2020-02-11T14:25:45.317Z   INFO    0 hostnames blocked overall
cfdns      | 2020-02-11T14:25:45.317Z   INFO    9 IP addresses blocked overall
cfdns      | 2020-02-11T14:25:45.317Z   INFO    starting unbound
cfdns      | 2020-02-11T14:25:45.318Z   INFO    using DNS address 127.0.0.1 internally
cfdns      | 2020-02-11T14:25:45.319Z   WARN    could not resolve github.com (try 1 of 10)
cfdns      | 2020-02-11T14:25:45.352Z   INFO    unbound: [1581431145] unbound[14:0] notice: init module 0: validator
cfdns      | 2020-02-11T14:25:45.352Z   INFO    unbound: [1581431145] unbound[14:0] notice: init module 1: iterator
cfdns      | 2020-02-11T14:25:45.385Z   INFO    unbound: [1581431145] unbound[14:0] info: start of service (unbound 1.9.6).
cfdns      | 2020-02-11T14:25:45.820Z   WARN    could not resolve github.com (try 2 of 10)
cfdns      | 2020-02-11T14:25:46.320Z   WARN    could not resolve github.com (try 3 of 10)
cfdns      | 2020-02-11T14:25:46.821Z   WARN    could not resolve github.com (try 4 of 10)
cfdns      | 2020-02-11T14:25:47.322Z   WARN    could not resolve github.com (try 5 of 10)
cfdns      | 2020-02-11T14:25:47.822Z   WARN    could not resolve github.com (try 6 of 10)
cfdns      | 2020-02-11T14:25:48.333Z   WARN    could not resolve github.com (try 7 of 10)
cfdns      | 2020-02-11T14:25:48.842Z   WARN    could not resolve github.com (try 8 of 10)
cfdns      | 2020-02-11T14:25:49.343Z   WARN    could not resolve github.com (try 9 of 10)
cfdns      | 2020-02-11T14:25:49.847Z   WARN    could not resolve github.com (try 10 of 10)
cfdns      | 2020-02-11T14:25:50.348Z   ERROR   Unbound does not seem to be working after 10 tries

Once I change to the latest shell-based image (tag: shell), everything seems okay.

cfdns      |  =========================================
cfdns      |  =========================================
cfdns      |  === CLOUDFLARE DNS OVER TLS CONTAINER ===
cfdns      |  =========================================
cfdns      |  =========================================
cfdns      |  == by github.com/qdm12 - Quentin McGaw ==
cfdns      |
cfdns      | Running as nonrootuser
cfdns      | Unbound version: 1.9.6
cfdns      | Unbound DNS server: cloudflare,quad9
cfdns      | Unbound listening UDP port: 8053
cfdns      | Caching is off
cfdns      | Verbosity level set to 1 on 5
cfdns      | Verbosity details level set to 0 on 4
cfdns      | Malicious hostnames and ips blocking is off
cfdns      | NSA hostnames blocking is off
cfdns      | Unbound private addresses: 127.0.0.1/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,::1/128,fc00::/7,fe80::/10,::ffff:0:0/96
cfdns      | [1581431328] unbound[36:0] notice: init module 0: validator
cfdns      | [1581431328] unbound[36:0] notice: init module 1: iterator
cfdns      | [1581431328] unbound[36:0] info: start of service (unbound 1.9.6).

Hope this helpful for development. Always thanks for your work.

ca-certificates

Hi! Just started using this image/container.

Is there a mechanism to update the ca-certificates.crt file? Seems like its updating it in /etc/ssl but not the copy in /unbound.

I know this is a bit old now and you might not be maintaining it anymore, but I figured I would ask.

unbound fails to start due to not being able to talk to github.

just fired this up in kubernetes, and got the following error

========= DNS over TLS container ========
=========================================
=========================================
=== Made with ❤  by github.com/qdm12 ====
=========================================

Running version latest built on 2020-03-20t01:31:43z (commit 4506edb)

📣  Supports IPv6 DNS resolution

🔧  Need help? https://github.com/qdm12/cloudflare-dns-server/issues/new
💻  Email? [email protected]
☕  Slack? Join from the Slack button on Github
💸  Help me? https://github.com/sponsors/qdm12
2020-03-21T19:43:41.032Z        INFO    Unbound version: 1.10.0
2020-03-21T19:43:41.033Z        INFO    Settings summary:
DNS over TLS provider:
|--cloudflare
Listening port: 53
Caching: enabled
Verbosity level: 3/5
Verbosity details level: 0/4
Validation log level: 0/2
Block malicious: enabled
Block surveillance: disabed
Block ads: disabed
Blocked hostnames:
Blocked IP addresses:
Allowed hostnames:
Private addresses:
 |--127.0.0.1/8
 |--10.0.0.0/8
 |--172.16.0.0/12
 |--192.168.0.0/16
 |--169.254.0.0/16
 |--::1/128
 |--fc00::/7
 |--fe80::/10
 |--::ffff:0:0/96
2020-03-21T19:43:41.033Z        INFO    using DNS address 1.1.1.1 internally
2020-03-21T19:43:41.033Z        INFO    downloading root hints from https://raw.githubusercontent.com/qdm12/files/master/named.root.updated
2020-03-21T19:43:41.243Z        INFO    downloading root key from https://raw.githubusercontent.com/qdm12/files/master/root.key.updated
2020-03-21T19:43:41.264Z        INFO    generating Unbound configuration
2020-03-21T19:43:42.195Z        INFO    116793 hostnames blocked overall
2020-03-21T19:43:42.195Z        INFO    182459 IP addresses blocked overall
2020-03-21T19:43:42.805Z        INFO    starting unbound
2020-03-21T19:43:42.806Z        INFO    using DNS address 127.0.0.1 internally
2020-03-21T19:43:42.807Z        WARN    could not resolve github.com (try 1 of 10): lookup github.com on 10.96.0.10:53: read udp 127.0.0.1:33612->127.0.0.1:53: read: connection refused
2020-03-21T19:43:43.309Z        WARN    could not resolve github.com (try 2 of 10): lookup github.com on 10.96.0.10:53: read udp 127.0.0.1:49110->127.0.0.1:53: read: connection refused
2020-03-21T19:43:43.507Z        INFO    unbound: [1584819823] unbound[23:0] debug: switching log to stderr
2020-03-21T19:43:44.514Z        INFO    unbound: [1584819824] unbound[23:0] debug: module config: "validator iterator"
2020-03-21T19:43:44.514Z        INFO    unbound: [1584819824] unbound[23:0] notice: init module 0: validator
2020-03-21T19:43:44.515Z        INFO    unbound: [1584819824] unbound[23:0] info: adding trusted key . DS IN
2020-03-21T19:43:44.515Z        INFO    unbound: [1584819824] unbound[23:0] info: adding trusted key . DS IN
2020-03-21T19:43:44.515Z        INFO    unbound: [1584819824] unbound[23:0] notice: init module 1: iterator
2020-03-21T19:43:44.515Z        INFO    unbound: [1584819824] unbound[23:0] debug: target fetch policy for level 0 is 3
2020-03-21T19:43:44.515Z        INFO    unbound: [1584819824] unbound[23:0] debug: target fetch policy for level 1 is 2
2020-03-21T19:43:44.515Z        INFO    unbound: [1584819824] unbound[23:0] debug: target fetch policy for level 2 is 1
2020-03-21T19:43:44.515Z        INFO    unbound: [1584819824] unbound[23:0] debug: target fetch policy for level 3 is 0
2020-03-21T19:43:44.515Z        INFO    unbound: [1584819824] unbound[23:0] debug: target fetch policy for level 4 is 0
2020-03-21T19:43:48.811Z        WARN    could not resolve github.com (try 3 of 10): lookup github.com on 10.96.0.10:53: read udp 127.0.0.1:57753->127.0.0.1:53: read: connection refused
2020-03-21T19:43:49.312Z        WARN    could not resolve github.com (try 4 of 10): lookup github.com on 10.96.0.10:53: read udp 127.0.0.1:42031->127.0.0.1:53: read: connection refused
2020-03-21T19:43:49.813Z        WARN    could not resolve github.com (try 5 of 10): lookup github.com on 10.96.0.10:53: read udp 127.0.0.1:42936->127.0.0.1:53: read: connection refused
2020-03-21T19:43:50.315Z        WARN    could not resolve github.com (try 6 of 10): lookup github.com on 10.96.0.10:53: read udp 127.0.0.1:60121->127.0.0.1:53: read: connection refused
2020-03-21T19:43:50.816Z        WARN    could not resolve github.com (try 7 of 10): lookup github.com on 10.96.0.10:53: read udp 127.0.0.1:38169->127.0.0.1:53: read: connection refused
2020-03-21T19:43:51.318Z        WARN    could not resolve github.com (try 8 of 10): lookup github.com on 10.96.0.10:53: read udp 127.0.0.1:50918->127.0.0.1:53: read: connection refused
2020-03-21T19:43:51.819Z        WARN    could not resolve github.com (try 9 of 10): lookup github.com on 10.96.0.10:53: read udp 127.0.0.1:58290->127.0.0.1:53: read: connection refused
2020-03-21T19:43:52.320Z        WARN    could not resolve github.com (try 10 of 10): lookup github.com on 10.96.0.10:53: read udp 127.0.0.1:43110->127.0.0.1:53: read: connection refused
2020-03-21T19:43:52.820Z        ERROR   Unbound does not seem to be working after 10 tries

my deployment:

apiVersion: v1
kind: Service
metadata:
  name: cloudflare-dns
spec:
  selector:
    app: cloudflare-dns
  type: LoadBalancer
  ports:
  - name: udpdns
    protocol: UDP
    port: 53
    targetPort: 53
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cloudflare-dns
  namespace: default
  annotations:
    flux.weave.works/automated: 'false'
spec:
  replicas: 2
  selector:
    matchLabels:
      app: cloudflare-dns
  template:
    metadata:
      labels:
        app: cloudflare-dns
    spec:
      nodeSelector:
        kubernetes.io/hostname: "homelab-a"
      containers:
      - name: cloudflare-dns
        image: qmcgaw/cloudflare-dns-server:latest
        env:
        - name: PUID
          value: '1001'
        - name: PGID
          value: '999'
        - name: TZ
          value: 'America/Los_Angeles'
        - name: PROVIDERS
          value: 'cloudflare'
        - name: VERBOSITY
          value: '3'
        resources:
          requests:
            memory: "16Mi"
            cpu: "128m"
          limits:
            memory: "128Mi"
            cpu: "500m"
        ports:
        - name: udpdns
          containerPort: 53
          protocol: UDP
        readinessProbe:
          tcpSocket:
            port: udpdns
          initialDelaySeconds: 5
          periodSeconds: 10
        livenessProbe:
          tcpSocket:
            port: udpdns
          initialDelaySeconds: 15
          periodSeconds: 20

is there a way to change the containers dns ip?

Container Fails to start

2020-12-15T13:23:43.321Z ERROR unbound version: exit status 127,
Running version latest built on 2020-12-15T03:39:51Z (commit a074849)

With the latest version, it looks like some problem with unbound. Maybe an unexpected version string?

Add more CPU architectures to Docker image for `v2.0.0`

Blocked by #61
Add all CPU architectures supported by Docker

Use Pi Hole Docker?

Hi,
I'm about to configure my Pi Hole, but on my home server and in container. First I wanted to use CF container with DNS over HTTPS, but I realized I saw your container.
I don't mind to use TLS instead of HTTPS, as I ser the only downside of TLS is that ISP can see that there are encrypted DNS requists sent from me. They can't see what and where.

Anyway, did you ever tried to configure this container with Pi Hole container? I saw some guides how to do this, I can post them if you are interested.

Feat: attach built binaries to releases with goreleaser

Blocked by #58 and #61
Add auto binary builds for linux, macos and windows for common CPU architectures for every release on Github

UNBLOCK environment variable isn't working

Here's my docker compose file:

version: '3.1'

services:
  cloudflare-dns-server:
    image: qmcgaw/cloudflare-dns-server
    restart: always
    volumes:
      - ./unbound/include.conf:/unbound/include.conf:ro
    environment:
      - BLOCK_MALICIOUS=off
      - BLOCK_SURVEILLANCE=on
      - BLOCK_ADS=on
      - PRIVATE_ADDRESS=192.168.1.0/24
      - UNBLOCK=maven.fabric.io
    ports:
      - 53:53/udp

When I run dig maven.fabric.io without blocking surveillance and ads it returns the IP. Example:

$ dig maven.fabric.io

; <<>> DiG 9.11.5-P4-5.1-Raspbian <<>> maven.fabric.io
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30856
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;maven.fabric.io.               IN      A

;; ANSWER SECTION:
maven.fabric.io.        3600    IN      A       13.226.16.232

;; Query time: 338 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Wed Mar 11 11:55:44 CDT 2020
;; MSG SIZE  rcvd: 60

When I run with the docker compose above, I get nothing back. Example:

$ dig maven.fabric.io

; <<>> DiG 9.11.5-P4-5.1-Raspbian <<>> maven.fabric.io
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 24691
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;maven.fabric.io.               IN      A

;; Query time: 0 msec
;; SERVER: 192.168.1.1#53(192.168.1.1)
;; WHEN: Wed Mar 11 11:54:43 CDT 2020
;; MSG SIZE  rcvd: 44

Unbound segmentation fault on Ubuntu 18.04 LTS

Issue

When running on Ubuntu 18.04 LTS, Unbound frequently experiences segmentation faults.

How to replicate

I have disabled systemd-resolved so I could bind the container to port 53 and in /etc/reslolv.conf, the nameserver address is set to 127.0.0.1. The container works with the always restart policy applied but still restarts frequently. I have tried this on Docker for Mac and have not experienced any of these issues. I can provide more information if needed.

Logs

Here is the minimal error log, with a more verbose log below.

=========================================
 =========================================
 === CLOUDFLARE DNS OVER TLS CONTAINER ===
 =========================================
 =========================================
 == by github.com/qdm12 - Quentin McGaw ==

Running as nonrootuser
Unbound version: 1.7.3
Unbound DNS server: cloudflare
Unbound listening UDP port: 53
Verbosity level set to 1 on 5
Verbosity details level set to 0 on 4
Malicious hostnames and ips blocking is off
[1549497232] unbound[24:0] warning: unable to initgroups nonrootuser: Operation not permitted
[1549497232] unbound[24:0] notice: init module 0: validator
[1549497232] unbound[24:0] notice: init module 1: iterator
[1549497232] unbound[24:0] info: start of service (unbound 1.7.3).
[1549497233] unbound[24:0] info: generate keytag query _ta-4a5c-4f66. NULL IN
[1549497233] unbound[24:1] info: generate keytag query _ta-4a5c-4f66. NULL IN

 =========================================
 Unbound exit with status 139
 =========================================
Segmentation fault (core dumped)

Max verbosity log

...
...
...
[1549507602] unbound[26:1] info: reply from <.> 1.1.1.1#853
[1549507602] unbound[26:1] info: incoming scrubbed packet: ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0
;; flags: qr rd ra ; QUERY: 1, ANSWER: 0, AUTHORITY: 6, ADDITIONAL: 0
;; QUESTION SECTION:
googleapis.com.	IN	DS

;; ANSWER SECTION:

;; AUTHORITY SECTION:
ck0pojmg874ljref7efn8430qvit8bsm.com.	85662	IN	NSEC3	1 1 0 - ck0q1gin43n1arrc9osm6qpqr81h5m9a NS SOA RRSIG DNSKEY NSEC3PARAM ;{flags: optout}
ck0pojmg874ljref7efn8430qvit8bsm.com.	85662	IN	RRSIG	NSEC3 8 2 86400 20190212213240 20190205202240 16883 com. lCQD2bK8qGow5GSWWDLcSOicHflSzVEchqETJAcMBURY+th9NtHF4nR9zeFWlZN8msSxnz1aAiUeQ7jRPXxV9cwHu2yPfR3iP0i1i5GiK98alVmwS4v2ylx4khb1WgJYeE7+CR+aEzKThjCTyPEDtBEvZFf9RCHZDPL4vPk2Xwk= ;{id = 16883}
com.	3600	IN	SOA	a.gtld-servers.net. nstld.verisign-grs.com. 1549506851 1800 900 604800 86400
com.	3600	IN	RRSIG	SOA 8 1 900 20190214023411 20190207012411 16883 com. u1lnSxqnSa2v/N52C1N4EM/It7o2CRDx+WZy0LqKyLHF6+pRhZ2c+B+5+5L8NQln8ZqitD9yJyCbvIBVgmAY+0MUftFGHWsdF2FVfALogofIl6d1IatCIKTqj9LM9bBTbSL1/GeE/HdRI0OGsiKR2yyBv0rhMmJovL9pv/p4Jcs= ;{id = 16883}
6l930cninqadn9he8d1tngam03ra30ou.com.	85662	IN	NSEC3	1 1 0 - 6l960svqib6ijqo2kvbdina1oefbd9hu NS DS RRSIG ;{flags: optout}
6l930cninqadn9he8d1tngam03ra30ou.com.	85662	IN	RRSIG	NSEC3 8 2 86400 20190210055006 20190203044006 16883 com. KXUO7RaL79Dy1v5/6d50k8mtgeVVAcgfdSvcmhzlw+gX/dx+X7va42oodO8xBl86s+lpXybU3kpfEvZVYvhKOmNHGSzP/zfzE4NDPjpxp3Fx/VHi25kC5C2rum4DMpPX5kldUYvdW6/BoBLdZ7n/oJt1r/skp+G8Uby/TBuoGF0= ;{id = 16883}

;; ADDITIONAL SECTION:
;; MSG SIZE  rcvd: 753

[1549507602] unbound[26:1] debug: iter_handle processing q with state QUERY RESPONSE STATE
[1549507602] unbound[26:1] info: query response was nodata ANSWER
[1549507602] unbound[26:1] debug: iter_handle processing q with state FINISHED RESPONSE STATE
[1549507602] unbound[26:1] info: finishing processing for googleapis.com. DS IN
[1549507602] unbound[26:1] debug: mesh_run: iterator module exit state is module_finished
[1549507602] unbound[26:1] debug: validator[module 0] operate: extstate:module_wait_module event:module_event_moddone
[1549507602] unbound[26:1] info: validator operate: query googleapis.com. DS IN
[1549507602] unbound[26:1] debug: validator: nextmodule returned
[1549507602] unbound[26:1] debug: not validating response, is valrec(validation recursion lookup)
[1549507602] unbound[26:1] debug: mesh_run: validator module exit state is module_finished
[1549507602] unbound[26:1] info: validator: inform_super, sub is googleapis.com. DS IN
[1549507602] unbound[26:1] info: super is clientservices.googleapis.com. A IN
[1549507602] unbound[26:1] info: verify rrset 6l930cninqadn9he8d1tngam03ra30ou.com. NSEC3 IN
[1549507602] unbound[26:1] debug: verify sig 16883 8
[1549507602] unbound[26:1] debug: verify result: sec_status_secure
[1549507602] unbound[26:1] debug: nsec3: keysize 1024 bits, max iterations 150
[1549507602] unbound[26:1] info: ce candidate com. TYPE0 CLASS0
[1549507602] unbound[26:1] info: NSEC3s for the referral proved no DS.
[1549507602] unbound[26:1] debug: validator[module 0] operate: extstate:module_wait_subquery event:module_event_pass
[1549507602] unbound[26:1] info: validator operate: query clientservices.googleapis.com. A IN
[1549507602] unbound[26:1] debug: val handle processing q with state VAL_VALIDATE_STATE
[1549507602] unbound[26:1] info: Verified that unsigned response is INSECURE
[1549507602] unbound[26:1] debug: val handle processing q with state VAL_FINISHED_STATE
[1549507602] unbound[26:1] debug: mesh_run: validator module exit state is module_finished
[1549507602] unbound[26:1] debug: query took 0.124501 sec
[1549507602] unbound[26:1] info: mesh_run: end 0 recursion states (0 with reply, 0 detached), 0 waiting replies, 4 recursion replies sent, 0 replies dropped, 0 states jostled out
[1549507602] unbound[26:1] info: average recursion processing time 0.151196 sec
[1549507602] unbound[26:1] info: histogram of recursion processing times
[1549507602] unbound[26:1] info: [25%]=0.0873813 median[50%]=0.109227 [75%]=0.131072
[1549507602] unbound[26:1] info: lower(secs) upper(secs) recursions
[1549507602] unbound[26:1] info:    0.065536    0.131072 3
[1549507602] unbound[26:1] info:    0.262144    0.524288 1
[1549507602] unbound[26:1] debug: cache memory msg=69352 rrset=73827 infra=8402 val=69892
[1549507602] unbound[26:1] debug: svcd callbacks end
[1549507602] unbound[26:1] debug: close fd 16
[1549507643] unbound[26:1] debug: udp request from ip4 172.16.34.142 port 15491 (len 16)
[1549507643] unbound[26:0] debug: udp request from ip4 172.16.34.142 port 50122 (len 16)
[1549507643] unbound[26:1] debug: mesh_run: start
[1549507643] unbound[26:0] debug: mesh_run: start
[1549507643] unbound[26:1] debug: validator[module 0] operate: extstate:module_state_initial event:module_event_new
[1549507643] unbound[26:0] debug: validator[module 0] operate: extstate:module_state_initial event:module_event_new
[1549507643] unbound[26:1] info: validator operate: query stackoverflow.com. A IN
[1549507643] unbound[26:0] info: validator operate: query www.gravatar.com. A IN
[1549507643] unbound[26:0] debug: validator: pass to next module
[1549507643] unbound[26:0] debug: mesh_run: validator module exit state is module_wait_module
[1549507643] unbound[26:1] debug: validator: pass to next module
[1549507643] unbound[26:0] debug: iterator[module 1] operate: extstate:module_state_initial event:module_event_pass
[1549507643] unbound[26:1] debug: mesh_run: validator module exit state is module_wait_module
[1549507643] unbound[26:0] debug: process_request: new external request event
[1549507643] unbound[26:1] debug: iterator[module 1] operate: extstate:module_state_initial event:module_event_pass
[1549507643] unbound[26:0] debug: iter_handle processing q with state INIT REQUEST STATE
[1549507643] unbound[26:1] debug: process_request: new external request event
[1549507643] unbound[26:0] info: resolving www.gravatar.com. A IN
[1549507643] unbound[26:1] debug: iter_handle processing q with state INIT REQUEST STATE
[1549507643] unbound[26:0] debug: request has dependency depth of 0
[1549507643] unbound[26:1] info: resolving stackoverflow.com. A IN
[1549507643] unbound[26:1] debug: request has dependency depth of 0
[1549507643] unbound[26:0] debug: forwarding request
[1549507643] unbound[26:1] debug: forwarding request
[1549507643] unbound[26:0] debug: iter_handle processing q with state QUERY TARGETS STATE
[1549507643] unbound[26:1] debug: iter_handle processing q with state QUERY TARGETS STATE
[1549507643] unbound[26:0] info: processQueryTargets: www.gravatar.com. A IN
[1549507643] unbound[26:1] info: processQueryTargets: stackoverflow.com. A IN
[1549507643] unbound[26:0] debug: processQueryTargets: targetqueries 0, currentqueries 0 sentcount 0
[1549507643] unbound[26:1] debug: processQueryTargets: targetqueries 0, currentqueries 0 sentcount 0
[1549507643] unbound[26:0] info: DelegationPoint<.>: 0 names (0 missing), 2 addrs (0 result, 2 avail) parentNS
[1549507643] unbound[26:1] info: DelegationPoint<.>: 0 names (0 missing), 2 addrs (0 result, 2 avail) parentNS
[1549507643] unbound[26:0] debug:   [cloudflare-dns.com] ip4 1.0.0.1 port 853 (len 16)
[1549507643] unbound[26:1] debug:   [cloudflare-dns.com] ip4 1.0.0.1 port 853 (len 16)
[1549507643] unbound[26:0] debug:   [cloudflare-dns.com] ip4 1.1.1.1 port 853 (len 16)
[1549507643] unbound[26:1] debug:   [cloudflare-dns.com] ip4 1.1.1.1 port 853 (len 16)
[1549507643] unbound[26:0] debug: attempt to get extra 3 targets
[1549507643] unbound[26:1] debug: attempt to get extra 3 targets
[1549507643] unbound[26:0] debug: servselect ip4 1.1.1.1 port 853 (len 16)
[1549507643] unbound[26:1] debug: servselect ip4 1.1.1.1 port 853 (len 16)
[1549507643] unbound[26:0] debug:    rtt=200
[1549507643] unbound[26:1] debug:    rtt=200
[1549507643] unbound[26:0] debug: servselect ip4 1.0.0.1 port 853 (len 16)
[1549507643] unbound[26:1] debug: servselect ip4 1.0.0.1 port 853 (len 16)
[1549507643] unbound[26:0] debug:    rtt=289
[1549507643] unbound[26:1] debug:    rtt=289
[1549507643] unbound[26:0] debug: selrtt 200
[1549507643] unbound[26:1] debug: selrtt 200
[1549507643] unbound[26:0] info: sending query: www.gravatar.com. A IN
[1549507643] unbound[26:1] info: sending query: stackoverflow.com. A IN
[1549507643] unbound[26:0] debug: sending to target: <.> 1.0.0.1#853
[1549507643] unbound[26:1] debug: sending to target: <.> 1.1.1.1#853
[1549507643] unbound[26:0] debug: dnssec status: not expected
[1549507643] unbound[26:1] debug: dnssec status: not expected
[1549507643] unbound[26:0] debug: comm point start listening 15
[1549507643] unbound[26:1] debug: comm point start listening 16
[1549507643] unbound[26:0] debug: mesh_run: iterator module exit state is module_wait_reply
[1549507643] unbound[26:1] debug: mesh_run: iterator module exit state is module_wait_reply
[1549507643] unbound[26:0] info: mesh_run: end 1 recursion states (1 with reply, 0 detached), 1 waiting replies, 2 recursion replies sent, 0 replies dropped, 0 states jostled out
[1549507643] unbound[26:1] info: mesh_run: end 1 recursion states (1 with reply, 0 detached), 1 waiting replies, 4 recursion replies sent, 0 replies dropped, 0 states jostled out
[1549507643] unbound[26:0] info: average recursion processing time 0.099110 sec
[1549507643] unbound[26:1] info: average recursion processing time 0.151196 sec
[1549507643] unbound[26:0] info: histogram of recursion processing times
[1549507643] unbound[26:1] info: histogram of recursion processing times
[1549507643] unbound[26:0] info: [25%]=0 median[50%]=0 [75%]=0
[1549507643] unbound[26:0] info: lower(secs) upper(secs) recursions
[1549507643] unbound[26:1] info: [25%]=0.0873813 median[50%]=0.109227 [75%]=0.131072
[1549507643] unbound[26:0] info:    0.065536    0.131072 2
[1549507643] unbound[26:1] info: lower(secs) upper(secs) recursions
[1549507643] unbound[26:0] info: 0RDd mod1 rep www.gravatar.com. A IN
[1549507643] unbound[26:1] info:    0.065536    0.131072 3
[1549507643] unbound[26:0] debug: cache memory msg=69352 rrset=73827 infra=8402 val=69892
[1549507643] unbound[26:1] info:    0.262144    0.524288 1
[1549507643] unbound[26:1] info: 0RDd mod1 rep stackoverflow.com. A IN
[1549507643] unbound[26:0] debug: udp request from ip4 172.16.34.142 port 63938 (len 16)
[1549507643] unbound[26:1] debug: cache memory msg=69352 rrset=73827 infra=8402 val=69892
[1549507643] unbound[26:0] debug: mesh_run: start
[1549507643] unbound[26:0] debug: validator[module 0] operate: extstate:module_state_initial event:module_event_new
[1549507643] unbound[26:0] info: validator operate: query cdn.sstatic.net. A IN
[1549507643] unbound[26:0] debug: validator: pass to next module
[1549507643] unbound[26:0] debug: mesh_run: validator module exit state is module_wait_module
[1549507643] unbound[26:0] debug: iterator[module 1] operate: extstate:module_state_initial event:module_event_pass
[1549507643] unbound[26:0] debug: process_request: new external request event
[1549507643] unbound[26:0] debug: iter_handle processing q with state INIT REQUEST STATE
[1549507643] unbound[26:0] info: resolving cdn.sstatic.net. A IN
[1549507643] unbound[26:0] debug: request has dependency depth of 0
[1549507643] unbound[26:0] debug: forwarding request
[1549507643] unbound[26:0] debug: iter_handle processing q with state QUERY TARGETS STATE
[1549507643] unbound[26:0] info: processQueryTargets: cdn.sstatic.net. A IN
[1549507643] unbound[26:0] debug: processQueryTargets: targetqueries 0, currentqueries 0 sentcount 0
[1549507643] unbound[26:0] info: DelegationPoint<.>: 0 names (0 missing), 2 addrs (0 result, 2 avail) parentNS
[1549507643] unbound[26:0] debug:   [cloudflare-dns.com] ip4 1.0.0.1 port 853 (len 16)
[1549507643] unbound[26:0] debug:   [cloudflare-dns.com] ip4 1.1.1.1 port 853 (len 16)
[1549507643] unbound[26:0] debug: attempt to get extra 3 targets
[1549507643] unbound[26:0] debug: servselect ip4 1.1.1.1 port 853 (len 16)
[1549507643] unbound[26:0] debug:    rtt=200
[1549507643] unbound[26:0] debug: servselect ip4 1.0.0.1 port 853 (len 16)
[1549507643] unbound[26:0] debug:    rtt=289
[1549507643] unbound[26:0] debug: selrtt 200
[1549507643] unbound[26:0] info: sending query: cdn.sstatic.net. A IN
[1549507643] unbound[26:0] debug: sending to target: <.> 1.1.1.1#853
[1549507643] unbound[26:0] debug: dnssec status: not expected
[1549507643] unbound[26:0] debug: comm point start listening 17
[1549507643] unbound[26:0] debug: mesh_run: iterator module exit state is module_wait_reply
[1549507643] unbound[26:0] info: mesh_run: end 2 recursion states (2 with reply, 0 detached), 2 waiting replies, 2 recursion replies sent, 0 replies dropped, 0 states jostled out
[1549507643] unbound[26:0] info: average recursion processing time 0.099110 sec
[1549507643] unbound[26:0] info: histogram of recursion processing times
[1549507643] unbound[26:0] info: [25%]=0 median[50%]=0 [75%]=0
[1549507643] unbound[26:0] info: lower(secs) upper(secs) recursions
[1549507643] unbound[26:0] info:    0.065536    0.131072 2
[1549507643] unbound[26:0] info: 0RDd mod1 rep cdn.sstatic.net. A IN
[1549507643] unbound[26:0] info: 1RDd mod1 rep www.gravatar.com. A IN
[1549507643] unbound[26:0] debug: cache memory msg=69352 rrset=73827 infra=8402 val=69892
[1549507643] unbound[26:0] debug: comm point listen_for_rw 15 0
[1549507643] unbound[26:1] debug: comm point listen_for_rw 16 0
[1549507643] unbound[26:0] debug: comm point listen_for_rw 17 0

 =========================================
 Unbound exit with status 139
 =========================================
Segmentation fault (core dumped)

LibreDNS still not working

Hi Quentin,
LibreDNS still does not work after the IP change fix. Can it be that LibreDNS does not support unencrypted DNS? Is there a quick solution for this?

logs:

=========================================
========= DNS over TLS container ========
=========================================
=========================================
=== Made with ❤️  by github.com/qdm12 ====
=========================================

Running version latest built on 2020-12-29T15:48:02Z (commit 347fe26)

🔧  Need help? https://github.com/qdm12/cloudflare-dns-server/issues/new
💻  Email? [email protected]
☕  Slack? Join from the Slack button on Github
💸  Help me? https://github.com/sponsors/qdm12
2020-12-29T16:48:35.970Z	INFO	Unbound version: 1.10.1
2020-12-29T16:48:35.970Z	INFO	Settings summary:
DNS over TLS provider:
|--libredns
Listening port: 53
Caching: enabled
IPv4 resolution: enabled
IPv6 resolution: disabled
Verbosity level: 1/5
Verbosity details level: 0/4
Validation log level: 0/2
Block malicious: enabled
Block surveillance: disabled
Block ads: disabled
Blocked hostnames:
Blocked IP addresses:
Allowed hostnames:
Private addresses: 
 |--127.0.0.1/8
 |--10.0.0.0/8
 |--172.16.0.0/12
 |--192.168.0.0/16
 |--169.254.0.0/16
 |--::1/128
�
 |--fc00::/7
 |--fe80::/10
 |--::ffff:0:0/96
Check Unbound: enabled
Update: every 24h0m0s
2020-12-29T16:48:35.970Z	INFO	using DNS address 116.202.176.26 internally
2020-12-29T16:48:35.971Z	INFO	healthcheck server: listening on 127.0.0.1:9999
2020-12-29T16:48:35.971Z	INFO	downloading root hints from https://raw.githubusercontent.com/qdm12/files/master/named.root.updated
2020-12-29T16:48:45.973Z	WARN	Get "https://raw.githubusercontent.com/qdm12/files/master/named.root.updated": dial tcp: lookup raw.githubusercontent.com on 127.0.0.11:53: read udp 192.168.2.6:50569->116.202.176.26:53: i/o timeout
2020-12-29T16:48:45.973Z	INFO	downloading root hints from https://raw.githubusercontent.com/qdm12/files/master/named.root.updated
2020-12-29T16:48:55.975Z	WARN	Get "https://raw.githubusercontent.com/qdm12/files/master/named.root.updated": dial tcp: lookup raw.githubusercontent.com on 127.0.0.11:53: read udp 192.168.2.6:52545->116.202.176.26:53: i/o timeout
2020-12-29T16:48:55.975Z	INFO	downloading root hints from https://raw.githubusercontent.com/qdm12/files/master/named.root.updated
2020-12-29T16:49:05.976Z	WARN	Get "https://raw.githubusercontent.com/qdm12/files/master/named.root.updated": dial tcp: lookup raw.githubusercontent.com on 127.0.0.11:53: read udp 192.168.2.6:37970->116.202.176.26:53: i/o timeout

unbound refuse all queries from clients

2021-01-02T18:02:10.352Z INFO unbound: [1609610530] unbound[20:0] debug: refused query from ip4 192.168.111.10 port 55901 (len 16) 2021-01-02T18:02:10.353Z INFO unbound: [1609610530] unbound[20:0] debug: refuse[76:0] 1345010000010000000000000D3139322D3136382D312D31343820363636346532653264363839343034646262663736366263623263633564663204706C6578066469726563740000010001
I rolled back to a docker image from 4 days ago and its working.

Scratch based image

Once #58 is merged and used, change the Docker image to be scratch based instead of Alpine based.

Restore the ability to have an include.conf for unbound.

Before the rewrite, it was possible to use include.conf to do custom unbound configs. I was using that, and hope that it can be restored.

It appears as though it would be pretty easily added to https://github.com/qdm12/cloudflare-dns-server/blob/master/internal/dns/conf.go

With just an extra line.

Would you be willing to add it, or accept a contribution adding it?

https://1.1.1.1/help reports that I'm not using HTTPS/TLS

So I just set this up.

Blocked port 53 except for Docker server (verified by trying to use external DNS servers from my client)
Started container, pointed my client machine's DNS only at the IP of the Docker server
Browsed to https://1.1.1.1/help

Connectivity to Resolver IP Addresses
1.1.1.1 | Yes
1.0.0.1 | Yes
2606:4700:4700::1111 | No
2606:4700:4700::1001 | No

What am I missing?

Disable DNS Caching

I've configured PiHole to send queries to this image. PiHole already handles DNS caching, so it would be nice if there was an option to disable caching inside of this image so that PiHole can handle all of that for us. That way, we're not double-caching results.

I did some light research to find the necessary Unbound config that would be needed to accomplish this, but the best solution I came across was to simply set the TTL to something very low with the cache-min-ttl option, which should produce the desired outcome.

DNS not working in conjunction with OpenVPN docker

I have this package up and running (thanks for your help), but it seems to break in a specific condition:

I have this docker container running with 53:8053/udp, and it works fine for clients on my LAN (192.168.2.X)
I have another docker container running an OpenVPN server, which is set to give out IP addresses in the 10.8.8.X range. I have set this up with a route to make sure that 10.8.8.X clients can talk to the 192.168.2.X network.
When a client connects to the OpenVPN server, it gets issued an IP and connects just fine. When I have the OpenVPN server use the cloudflare-dns-server as its DNS, things start to break. However when I have the OpenVPN server use any other DNS, such as 9.9.9.9 or 1.1.1.1 directly, the clients can resolve DNS queries just fine.

Troubleshooting:

I have watched the logs of the cloudflare-dns-server container, and I can confirm that indeed the DNS traffic is getting to the container, because I see activity in the logs, so it doesn't seem like a docker setup issue.
I tried modifying the unbound.conf file and commented out the private IP lines to see if that would make a difference, and it didn't appear to. (I was sure to only stop and restart the container, rather than rebuild, because obivously the unbound.conf would be over-written).

So for now I am not sure what else to try. Any ideas?

Add support for oblivious DNS

https://blog.cloudflare.com/oblivious-dns/

add option to disable IPV6 lookups

This works great (thanks again, btw), but there's one issue...IPV6 lookups. Can you add support for an environmental variable like "USE_IPV6", that sets an unbound config "do-ipv6: yes/no"?

I get the following errors every time a lookup occurs:

2020-04-18T04:15:38.317Z        INFO    unbound: [1587183338] unbound[13:1] info: resolving am-a.akamaihd.net.edgesuite.net. A IN
2020-04-18T04:15:38.317Z        INFO    unbound: [1587183338] unbound[13:1] error: outgoing tcp: connect: Address not available for 2001:4860:4860::8888 port 853
2020-04-18T04:15:38.318Z        INFO    unbound: [1587183338] unbound[13:1] info: error sending query to auth server 2001:4860:4860::8888 port 853
2020-04-18T04:15:38.318Z        INFO    unbound: [1587183338] unbound[13:1] error: outgoing tcp: connect: Address not available for 2001:4860:4860::8844 port 853
2020-04-18T04:15:38.318Z        INFO    unbound: [1587183338] unbound[13:1] info: error sending query to auth server 2001:4860:4860::8844 port 853
2020-04-18T04:15:38.318Z        INFO    unbound: [1587183338] unbound[13:1] error: outgoing tcp: connect: Address not available for 2001:4860:4860::8888 port 853
2020-04-18T04:15:38.319Z        INFO    unbound: [1587183338] unbound[13:1] info: error sending query to auth server 2001:4860:4860::8888 port 853
2020-04-18T04:15:38.319Z        INFO    unbound: [1587183338] unbound[13:1] error: outgoing tcp: connect: Address not available for 2606:4700:4700::1001 port 853
2020-04-18T04:15:38.319Z        INFO    unbound: [1587183338] unbound[13:1] info: error sending query to auth server 2606:4700:4700::1001 port 853
2020-04-18T04:15:38.319Z        INFO    unbound: [1587183338] unbound[13:1] error: outgoing tcp: connect: Address not available for 2606:4700:4700::1001 port 853
2020-04-18T04:15:38.319Z        INFO    unbound: [1587183338] unbound[13:1] info: error sending query to auth server 2606:4700:4700::1001 port 853
2020-04-18T04:15:38.319Z        INFO    unbound: [1587183338] unbound[13:1] error: outgoing tcp: connect: Address not available for 2606:4700:4700::1111 port 853
2020-04-18T04:15:38.319Z        INFO    unbound: [1587183338] unbound[13:1] info: error sending query to auth server 2606:4700:4700::1111 port 853
2020-04-18T04:15:38.319Z        INFO    unbound: [1587183338] unbound[13:1] error: outgoing tcp: connect: Address not available for 2001:4860:4860::8844 port 853
2020-04-18T04:15:38.319Z        INFO    unbound: [1587183338] unbound[13:1] info: error sending query to auth server 2001:4860:4860::8844 port 853
2020-04-18T04:15:38.319Z        INFO    unbound: [1587183338] unbound[13:1] error: outgoing tcp: connect: Address not available for 2606:4700:4700::1111 port 853
2020-04-18T04:15:38.319Z        INFO    unbound: [1587183338] unbound[13:1] info: error sending query to auth server 2606:4700:4700::1111 port 853
2020-04-18T04:15:38.363Z        INFO    unbound: [1587183338] unbound[13:1] info: response for am-a.akamaihd.net.edgesuite.net. A IN
2020-04-18T04:15:38.363Z        INFO    unbound: [1587183338] unbound[13:1] info: reply from <.> 1.0.0.1#853

it eventually hits the IPV4 resolver, but it tries to use ipv6 first in kubernetes.

Thanks!

conflicts with dnsmasq in Manjaro Linux

Hi. I've started to use Manjaro Linux recently. At first, the docker container just worked fine.

But when I have set up the wifi adapter as hotspot, the docker container exited immediately and I came to know dnsmasq is using the port 53. When I killed the process of dnsmasq, the wifi hotspot did not reach the internet.

What I have already tried:

edit the port in /etc/dnsmasq.conf
edit the port in /etc/NetworkManager/dnsmasq.d/dnsmasq.conf
set dns=none/default/dnsmasq in /etc/NetworkManager/conf.d/dns.conf
set dns=none/default/dnsmasq in /etc/NetworkManager/NetworkManager.conf
set dns=none/default/dnsmasq in /etc/NetworkManager/system-connections/*.nmconnection

I've read about NetworkManager in Arch Wiki but could not find the solution.
Do you have any idea to solve the issue?

Error Starting Last Docker Image

Hi,

I don't know if it's just my case.

The image works correctly, but at the moment I add the variable BLOCK_NSA = on it does not work.

The following error appears with the docker logs "container" command

Thank you.

Running as nonrootuser
Unbound version: 1.9.4
Unbound DNS server: cloudflare, quad9
Unbound listening UDP port: 53
Caching is on
Verbosity level set to 1 on 5
Verbosity details level set to 0 on 4
Malicious hostnames and ips blocking is on
44398 malicious hostnames and 177354 malicious IP addresses blacklisted
NSA hostnames blocking is on
8146 NSA hostnames blacklisted
Unbound private addresses: 127.0.0.1/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,::1/128,fc00::/7,fe80::/10,::ffff: 0: 0/96
blocks-malicious.conf: 446: error: newline inside quoted string, no end "
blocks-malicious.conf: 447: error: stray '"'
blocks-malicious.conf: 447: error: unknown keyword 'static'
blocks-malicious.conf: 448: error: syntax error
read unbound.conf failed: 4 errors in configuration file
[1573485253] unbound [53: 0] fatal error: Could not read config file: unbound.conf. Maybe try unbound -dd, it stays on the commandline to see more errors, or unbound-checkconf

feature request: expose metrics

Hey it'd be a great feature if you created and exposed the cloudflared/stubby metrics so I could have prometheus scrape them

Opting out of "DNS rebinding" IP blocking

I found it surprising that after setting all BLOCK_ options to off this server still blocks several IP ranges. It would be nice if there was an easy way to fully opt out so that tools like xip.io behave as expected.

Would you consider adding a BLOCK_DNS_REBINDING option, or at least moving that configuration into a blocks-dns-rebinding.conf for easier overriding?

Ability to specifiy filters for cloudflare / cleanbrowsing

Hi,

Im looking for a way to specify which IP's are used for cloudflare and cleanbrowsing to enable other functions such as adult filters.

Cloudflare
Standard 1.1.1.1 / 1.0.0.1 This is the default selected
Malware-blocking 1.1.1.2 / 1.0.0.2
Malware and adult content-blocking 1.1.1.3 / 1.0.0.3

Cleanbrowsing
Security Filter 185.228.168.9: Malicious domains blocked (phishing, malware). - This is the default selected
Adult Filter 185.228.168.10: Adult domains blocked; Search Engines set to safe mode; +Security Filter
Family Filter 185.228.168.168: Proxies, VPNs & Mixed Adult Content blocked; Youtube to safe mode; +Adult Filter

Thankyou

ERROR: Cannot locate specified Dockerfile: Dockerfile

I use docker compose on a arm64 server and get the following error:

~/container-conf/tls-dns-server$ docker-compose up
Building cloudflare-dns-tls
ERROR: Cannot locate specified Dockerfile: Dockerfile

Here is my compose file:

version: "3.7"
services:
  cloudflare-dns-tls:
    build: .
    image: qmcgaw/cloudflare-dns-server
    container_name: cloudflare-dns-tls
    environment:
      - VERBOSITY=1
      - VERBOSITY_DETAILS=1
      - BLOCK_MALICIOUS=off
      - BLOCK_NSA=off
      - BLOCK_SURVEILLANCE=off
      - BLOCK_ADS=off
      - CACHING=off
      - PROVIDER=google,quad9
    ports:
      - 53:53/udp
    network_mode: bridge
    restart: unless-stopped