OpenBSD manual page server

Manual Page Search Parameters

UNWIND.CONF(5) File Formats Manual UNWIND.CONF(5)

unwind.confvalidating DNS resolver configuration file

The unwind(8) daemon is a validating DNS resolver.

The unwind.conf config file is divided into the following main sections:

User-defined variables may be defined and used later, simplifying the configuration file.
Global settings for unwind(8).

Additional configuration files can be included with the include keyword.

Macros can be defined that will later be expanded in context. Macro names must start with a letter, digit, or underscore, and may contain any of those characters. Macro names may not be reserved words (for example, forwarder, port, or DoT). Macros are not expanded inside quotes.

For example:

fwd1=192.0.2.53
fwd2=192.0.2.153
forwarder { $fwd1 $fwd2 }

file [log]
A file containing domains to block, one per line. If a domain from this list is queried unwind answers with a return code of refused. With log blocked queries are logged.
{address [port number] [[authentication name name] DoT] ...}
A list of addresses of DNS name servers to forward queries to. port defaults to 53. If DoT is specified, use DNS over TLS when sending queries to the server at address. The default port is 853. name validates the certificate of the DNS over TLS server.
{type ...}
A list of DNS name server types to specify the order in which name servers are picked when measured round-trip time medians are equal. Additionally, the first mentioned type gets a time bonus. Validating name servers are always picked over non-validating name servers. DNS name server types are:

Name servers learned via DHCP, queried using the libc functions. See asr_run(3). Will never validate. Useful when running behind broken middle boxes that do not like edns0. DNS answers from stub name servers are not cached.
Name servers learned via DHCP or SLAAC.
Name servers learned via DHCP or SLAAC. unwind tries to opportunistically use DNS over TLS.
DNS over TLS name servers configured in unwind.conf.
Name servers configured in unwind.conf.
Name servers configured in unwind.conf. unwind tries to opportunistically use DNS over TLS.
unwind itself recursively resolves names.

The default preference is DoT oDoT-forwarder forwarder recursor oDoT-dhcp dhcp stub.

[accept bogus] type {name ...}
Force resolving of name and its subdomains by the given resolver type. If accept bogus is specified validation is not enforced.

/etc/unwind.conf
The default unwind(8) configuration file.

Block requests from hostnames in /etc/blocklist and log each blocked request:

block list "/etc/blocklist" log

Define a DNS over TLS (DoT) forwarder and make it the preferred resolver:

forwarder 192.168.1.250 port 8080 authentication name "resolver.local" DoT
preference DoT

Where a domain requires a specific nameserver and it may only exist in a nameserver available on the local network, force unwind(8) to use a specific resolver type:

force dhcp { domain.local }

rc.conf.local(8), unwind(8), unwindctl(8)

The unwind.conf file format first appeared in OpenBSD 6.5.

February 20, 2021 OpenBSD-current