Table of Contents

Networking - DNS - Unbound - Selectively override DNS records

To add some local information into the normal DNS data.

Override an A record

local-zone: example.org typetransparent
local-data: "server.example.org A 8.8.8.8"

NOTE: Any other DNS records for server.example.org will be returned as-is, such as MX records. 

local-zone: example.com transparent
local-data: "server.example.com A 9.9.9.9"

NOTE: This also effectively deleted all other DNS records for it. If it has an MX record or a TXT record or what have you, those records will not be visible.

  • For any names in transparent local-data zones, you are in complete control of all records returned;
    • either they are in your local-data stanzas, or they do not exist.
  • If you just give local-data for something without a local-zone directive, Unbound silently makes it into such a transparent local zone.

WARNING: Transparent local zones have one gotcha: 

local-zone: example.net transparent
local-data: "example.net A 7.7.7.7"
  • Because this is a transparent zone and we have not listed any NS records for example.net as part of our local data, people will not be able to look up any names inside the zone even though we don't explicitly block or override them.
  • Of course if we did list some additional names inside example.net as local-data, people would be able to look up them (and only them).
  • Also, since transparent local zones are the default, this happens if you leave out the local-zone or get the name wrong by mistake or accident.

typetransparent zones

There is no way to use a typetransparent zone but delete certain record types for some names, which you would use so you can do things like remove all MX entries for some host names.

Zones, however, do not have to map to actual DNS zones, so you can do this: 

# Instead of this:

local-zone: example.org typetransparent
local-data: "server.example.org A 8.8.8.8"
 
# but:

local-zone: www.example.org transparent
local-data: "www.example.org A 8.8.8.8"

NOTE: By claiming www.example.org as a separate transparent local zone, this allows us to delete all records for it but the A record that we supply;

  • This would remove, say, MX entries.
  • A transparent local zone with no data naturally does not blank out anything, so if you want to totally delete a name's records you need to supply some dummy record (e.g. a TXT record).