unbound not caching HINFO?

[bcookatpcsd]

;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 17852
;; flags: qr ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; widget-mediator.zopim.com.   IN      A

;; ANSWER SECTION:
widget-mediator.zopim.com.      600     IN      HINFO   "This query has been locally blocked" "by dnscrypt-proxy"

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 0 msec
;; EDNS: version 0; flags: ; udp: 4048
;; SERVER: 10.20.32.100
;; WHEN: Tue Jul 27 10:36:18 2021
;; MSG SIZE  rcvd: 120

When I ask dnscrypt-proxy directly I get a response, of HINFO type.

;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 41521
;; flags: qr rd ra ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; widget-mediator.zopim.com.   IN      A

;; ANSWER SECTION:

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 1 msec
;; SERVER: 10.20.0.43
;; WHEN: Tue Jul 27 10:36:30 2021
;; MSG SIZE  rcvd: 43

When I ask unbound I nothing..

    name: "."
    forward-addr: 10.20.32.100@5353

unbound setup to forward to dnscrypt

@4000000061001b3905f9f9d4 [1627396911] unbound[30211:0] info: 10.20.8.29 widget-mediator.zopim.com. A IN
unbound shows the query came in.. but for an A record.. and dnscrypt is answering with an HINFO

But then when I change dnscrypt-proxy to be reject
@4000000061001ba01c463a54 [2021-07-27 10:43:34] 10.20.8.29 widget-mediator.zopim.com A REJECT 0ms -

Dnscrypt says it was rejected

;; ->>HEADER<<- opcode: QUERY, rcode: REFUSED, id: 49362
;; flags: qr ra ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; widget-mediator.zopim.com.   IN      A

;; ANSWER SECTION:

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 0 msec
;; EDNS: version 0; flags: ; udp: 4048
;; SERVER: 10.20.32.100
;; WHEN: Tue Jul 27 10:43:34 2021
;; MSG SIZE  rcvd: 54

But then I get a REFUSED response and no answer..

So back to dnscrypt, I change blocked_query_response = 'a:127.0.0.192'

I now get an A record response, which seems to get cached by unbound and dnsdist..

where as an HINFO record was not cached..

being that I can't get unbound or dnsdist to block AAAA queries and not cause other issues..

blocked_query_response = 'a:127.0.0.192,aaaa:::1/128'

Second question..

Is that the correct syntax for the AAAA response?

;; ANSWER SECTION:
widget-mediator.zopim.com.      600     IN      AAAA    ::ffff:127.0.0.192

Adding the A and AAAA responses seem to make dnscrypt-proxy work more efficiently as responses are actually cached upstream..

Thank you, as always, for taking the time to read these..

[jedisct1]

In order to check if unbound cached a response, compare the unbound query log with the dnscrypt-proxy query log.

If repeated queries appear in the unbound query log, but not in the dnscrypt-proxy query log, it means that it was cached by unbound.