"How to" - Local DNS Resolver for Proxmox Mail Gateway

ChFin · Feb 5, 2018

In the PMG Admin Manual the following DNS recommendation is proposed:

DNS recommendations
Many tests to detect SPAM mails use DNS queries, so it is important to have a fast and reliable DNS server. We also query some public available DNS Blacklists. Most of them apply rate limits for clients, so they simply will not work if you use a public DNS server (because they are usually blocked). We recommend to use your own DNS server, which need to be configured in recursive mode.

In this "How To" it is explained how you can setup a IPv4 caching DNS server (resolver) on top on Debian 9 (stretch).

The bind software is available in the local debian repository. So just make sure that your system is up to date and install the bind components.

# apt-get update && apt-get dist-upgrade
# apt-get install bind9 bind9utils bind9-doc

After the bind components are installed you can configure the service.

# cd /etc/bind
# vi named.conf.options

Above the "options" block create a new block called "acl". Call the new group "goodclients".
Within this block list the IP addresses or networks that should be allowed to query the DNS service.
(also 'localhost' and/or 'localnets' can be used)

acl goodclients {
localhost;
localnets;
};

options {
. . .

Now we can configure the "options" block. Explicitly turn recursion on and then configure the allow-query parameter to allow to use our ACL specification.

options {
directory "/var/cache/bind";

recursion yes;
allow-query { goodclients; };
. . .

As we use only IPv4, comment the listen-on-v6 parameter or set it to

listen-on-v6 { none; };

Edit the bind startup options to enforce IPv4.

# vi /etc/default/bind9

Inside, modify the "OPTIONS" parameter to include the '-4' flag

OPTIONS="-u bind -4"

Finally check your named configuration. If you have syntax errors correct them.

# named-checkconf

Edit resolv.conf to use your local resolver

# vi /etc/resolv.conf

search . . .
nameserver 127.0.0.1

When you have verified that your configuration is without syntax errors restart the DNS service and keep an eye on the logfiles (daemon.log, mail.log, ...).

# systemctl restart bind9.service

*** Now all DNS Tests done by PMG should work without being blocked due to rate limits ***

Christoph Engelbert · Feb 13, 2018

I used dnsmasq but bind obviously works too

Even though it already works for me, still thanks for sharing. Guess plenty of people will hit the blocklist rate limits

ChFin · Feb 13, 2018

"Dnsmasq is a DNS query forwarder: it it not capable of recursively answering arbitrary queries starting from the root servers but forwards such queries to a fully recursive upstream DNS server which is typically provided by an ISP." (http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html)

You need a recursive DNS resolver ... (not a forwarder)

ChFin · Feb 13, 2018

How to check your outside IPv4/IPv6 of your DNS Server (Who am I):

# dig o-o.myaddr.l.google.com -t txt +short

# dig -t a whoami.v4.powerdns.org +short
# dig -t aaaa whoami.v6.powerdns.org +short

# dig -t txt whoami.v4.powerdns.org +short
# dig -t txt whoami.v6.powerdns.org +short

# dig -t txt whoami-ecs.v4.powerdns.org +short
# dig -t txt whoami-ecs.v6.powerdns.org +short

# dig -t a whoami.akamai.net +short
# dig -t aaaa whoami.akamai.net +short

Christoph Engelbert · Feb 14, 2018

ChFin said:
"Dnsmasq is a DNS query forwarder: it it not capable of recursively answering arbitrary queries starting from the root servers but forwards such queries to a fully recursive upstream DNS server which is typically provided by an ISP." (http://www.thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html)

You need a recursive DNS resolver ... (not a forwarder)

For me the important part was to get my own quota, not to really cache internally. The provider was just constantly hitting the RBL quota. Maybe I'll need to setup bind at some point, so far I'm ok. Anyhow normally bind might be the better option!

DerDanilo · Feb 26, 2018

ChFin said:
In the PMG Admin Manual the following DNS recommendation is proposed:

DNS recommendations
Many tests to detect SPAM mails use DNS queries, so it is important to have a fast and reliable DNS server. We also query some public available DNS Blacklists. Most of them apply rate limits for clients, so they simply will not work if you use a public DNS server (because they are usually blocked). We recommend to use your own DNS server, which need to be configured in recursive mode.

In this "How To" it is explained how you can setup a IPv4 caching DNS server (resolver) on top on Debian 9 (stretch).

The bind software is available in the local debian repository. So just make sure that your system is up to date and install the bind components.

# apt-get update && apt-get dist-upgrade
# apt-get install bind9 bind9utils bind9-doc

After the bind components are installed you can configure the service.

# cd /etc/bind
# vi named.conf.options

Above the "options" block create a new block called "acl". Call the new group "goodclients".
Within this block list the IP addresses or networks that should be allowed to query the DNS service.
(also 'localhost' and/or 'localnets' can be used)

acl goodclients {
localhost;
localnets;
};

options {
. . .

Now we can configure the "options" block. Explicitly turn recursion on and then configure the allow-query parameter to allow to use our ACL specification.

options {
directory "/var/cache/bind";

recursion yes;
allow-query { goodclients; };
. . .

As we use only IPv4, comment the listen-on-v6 parameter or set it to

listen-on-v6 { none };

Edit the bind startup options to enforce IPv4.

# vi /etc/default/bind9

Inside, modify the "OPTIONS" parameter to include the '-4' flag

OPTIONS="-u bind -4"

Finally check your named configuration. If you have syntax errors correct them.

# named-checkconf

Edit resolv.conf to use your local resolver

# vi /etc/resolv.conf

search . . .
nameserver 127.0.0.1

When you have verified that your configuration is without syntax errors restart the DNS service and keep an eye on the logfiles (daemon.log, mail.log, ...).

# systemctl restart bind9.service

*** Now all DNS Tests done by PMG should work without being blocked due to rate limits ***

Where does one define the upstream DNS servers?

ChFin · Feb 26, 2018

DerDanilo said:
Where does one define the upstream DNS servers?

You don't want to forward any DNS query with spamassassin.

DerDanilo · Feb 26, 2018

ChFin said:
You don't want to forward any DNS query with spamassassin.

My bad, i meant downstream.

uy01 · Feb 28, 2018

i had to change:
listen-on-v6 { none };

to
listen-on-v6 { none; };

thanks for this HOWTO. i suggest to strik it. I also suggest to include local recursive dns by defaul tin next releases.

DerDanilo · Feb 28, 2018

Thanks for the how to!

@proxmox team:
Is there a wiki for PMG like https://pve.proxmox.com/wiki/Main_Page ?

tom · Mar 2, 2018

DerDanilo said:
Thanks for the how to!

@proxmox team:
Is there a wiki for PMG like https://pve.proxmox.com/wiki/Main_Page ?

No, the documentation is core part of the product itself (via the help button). For now, please howtos just in the forum.

DerDanilo · Mar 2, 2018

tom said:
No, the documentation is core part of the product itself (via the help button). For now, please howtos just in the forum.

Can we have a new section for how to's in the forum then, please?
Easier to have them connected.

Otherwise tagging might work of the forum can create lists of posts based on tags.

magenbrot · Mar 4, 2018

I'm using "unbound" as DNS resolver, it's not as, erm, "matured" like bind. unbound is easy to configure, can do DNSSEC validation.

This is my current configuration:

Code:

#
# server section
#
server:
    # The following line will configure unbound to perform cryptographic
    # DNSSEC validation using the root trust anchor.
    auto-trust-anchor-file: "/var/lib/unbound/root.key"
    # interfaces
    interface: 127.0.0.1
    interface: ::1
    # ACLS
    access-control: 10.0.0.0/8 allow
    access-control: 172.16.0.0/12 allow
    access-control: 192.168.0.0/16 allow
    # some config options
    so-rcvbuf: 4m
    so-sndbuf: 4m
    msg-cache-size: 8m
    rrset-cache-size: 8m
    cache-max-ttl: 14400
    cache-min-ttl: 900
    minimal-responses: yes
    qname-minimisation: yes
    use-caps-for-id: yes
    do-ip6: yes
    hide-identity: yes
    hide-version: yes
    harden-short-bufsize: yes
    harden-large-queries: yes
    harden-glue: yes
    harden-below-nxdomain: yes
    prefetch: yes
    rrset-roundrobin: yes
    key-cache-size: 8m

KatyComputer · Oct 10, 2019

Another option: PowerDNS
Install: apt-get install pdns-recursor -y
Edit allow-from: nano /etc/powerdns/recursor.conf
Restart things: /etc/init.d/pdns-recursor restart
Set local recursor: nano /etc/resolv.conf
Restart network: systemctl restart networking
Test things: dig google.com

heutger · Oct 18, 2019

I googled some documentation about resolvers, their speed, reliability and how fast they reject unknown queries, work on timeouts etc. It looked like that Unbound is most reliable for the use in PMG environment.

ithelpdesk · Nov 5, 2019

heutger said:
I googled some documentation about resolvers, their speed, reliability and how fast they reject unknown queries, work on timeouts etc. It looked like that Unbound is most reliable for the use in PMG environment.

Dear Danilo,

Can u explian me how to install and configure UNBOUND in my Proxmox Email gateway ?

Regards,
Liju

ithelpdesk · Nov 5, 2019

magenbrot said:

I'm using "unbound" as DNS resolver, it's not as, erm, "matured" like bind. unbound is easy to configure, can do DNSSEC validation.

This is my current configuration:

Code:

#
# server section
#
server:
    # The following line will configure unbound to perform cryptographic
    # DNSSEC validation using the root trust anchor.
    auto-trust-anchor-file: "/var/lib/unbound/root.key"
    # interfaces
    interface: 127.0.0.1
    interface: ::1
    # ACLS
    access-control: 10.0.0.0/8 allow
    access-control: 172.16.0.0/12 allow
    access-control: 192.168.0.0/16 allow
    # some config options
    so-rcvbuf: 4m
    so-sndbuf: 4m
    msg-cache-size: 8m
    rrset-cache-size: 8m
    cache-max-ttl: 14400
    cache-min-ttl: 900
    minimal-responses: yes
    qname-minimisation: yes
    use-caps-for-id: yes
    do-ip6: yes
    hide-identity: yes
    hide-version: yes
    harden-short-bufsize: yes
    harden-large-queries: yes
    harden-glue: yes
    harden-below-nxdomain: yes
    prefetch: yes
    rrset-roundrobin: yes
    key-cache-size: 8m

IS DNS sec Validiation config is free to use for everyone?

heutger · Nov 22, 2019

ithelpdesk said:
Dear Danilo,

Can u explian me how to install and configure UNBOUND in my Proxmox Email gateway ?

Regards,
Liju

You can find setup steps in my Advancing Proxmox Thread. However it's very easy.

DerDanilo · Dec 7, 2019

I started using Ansible more and more. I can provide you with the Ansible code if you wish.

Jose Gamboa · Oct 4, 2020

[QUOTE = "DerDanilo, publicación: 281845, miembro: 42891"]
Empecé a usar Ansible cada vez más. Puedo proporcionarle el código Ansible si lo desea.
[/CITAR]

Si aun tienes el servicio operativo, puedes compartir las guia codigos?

"How to" - Local DNS Resolver for Proxmox Mail Gateway

Well-Known Member

Active Member

Well-Known Member

Well-Known Member

Active Member

Renowned Member

Well-Known Member

Renowned Member

New Member

Renowned Member

Proxmox Staff Member

Renowned Member

Active Member

Well-Known Member

Famous Member

Member

Member

Famous Member

Renowned Member

Member