DNS/実装/unbound/harden-referral-path/動作確認/onについて、ここに記述してください。
$ unbound-control set_option harden-referral-path yes ok tmaeno@u16:~$ unbound-control flush_zone brau.jp ok removed 3 rrsets, 1 messages and 0 key entries tmaeno@u16:~$ dig poison.brau.jp @127.0.0.3 ; <<>> DiG 9.12.3 <<>> poison.brau.jp @127.0.0.3 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 22244 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1220 ;; QUESTION SECTION: ;poison.brau.jp. IN A ;; AUTHORITY SECTION: brau.jp. 2560 IN SOA a.ns.brau.jp. hostmaster.brau.jp. 1543968754 16384 2048 1048576 2560 ;; Query time: 167 msec ;; SERVER: 127.0.0.3#53(127.0.0.3) ;; WHEN: 水 12月 05 13:56:31 JST 2018 ;; MSG SIZE rcvd: 95 tmaeno@u16:~$
[1543985773] unbound[7346:0] info: control cmd: set_option harden-referral-path yes [1543985785] unbound[7346:0] info: control cmd: flush_zone brau.jp [1543985790] unbound[7346:0] info: resolving poison.brau.jp. A IN [1543985791] unbound[7346:0] info: response for poison.brau.jp. A IN [1543985791] unbound[7346:0] info: reply from <jp.> 65.22.40.25#53 [1543985791] unbound[7346:0] info: query response was REFERRAL [1543985791] unbound[7346:0] info: resolving brau.jp. NS IN [1543985791] unbound[7346:0] info: response for brau.jp. NS IN [1543985791] unbound[7346:0] info: reply from <jp.> 202.12.30.131#53 [1543985791] unbound[7346:0] info: query response was REFERRAL [1543985791] unbound[7346:0] info: resolving a.ns.brau.jp. A IN [1543985791] unbound[7346:0] info: response for poison.brau.jp. A IN [1543985791] unbound[7346:0] info: reply from <brau.jp.> 14.192.44.29#53 [1543985791] unbound[7346:0] info: query response was NXDOMAIN ANSWER [1543985791] unbound[7346:0] info: response for a.ns.brau.jp. A IN [1543985791] unbound[7346:0] info: reply from <brau.jp.> 14.192.44.29#53 [1543985791] unbound[7346:0] info: query response was NXDOMAIN ANSWER [1543985791] unbound[7346:0] info: resolving ns.brau.jp. A IN [1543985791] unbound[7346:0] info: response for brau.jp. NS IN [1543985791] unbound[7346:0] info: reply from <brau.jp.> 14.192.44.29#53 [1543985791] unbound[7346:0] info: query response was ANSWER [1543985791] unbound[7346:0] info: response for a.ns.brau.jp. A IN [1543985791] unbound[7346:0] info: reply from <brau.jp.> 14.192.44.29#53 [1543985791] unbound[7346:0] info: query response was ANSWER
最後のreplyで毒NSを取り込んでいるから、これは当然の結果
$ dig poison2.brau.jp @127.0.0.3 ; <<>> DiG 9.12.3 <<>> poison2.brau.jp @127.0.0.3 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37510 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1220 ;; QUESTION SECTION: ;poison2.brau.jp. IN A ;; ANSWER SECTION: poison2.brau.jp. 86400 IN A 10.10.1.1 ;; Query time: 10 msec ;; SERVER: 127.0.0.3#53(127.0.0.3) ;; WHEN: 水 12月 05 13:59:48 JST 2018 ;; MSG SIZE rcvd: 60
[1543985988] unbound[7346:0] info: resolving poison2.brau.jp. A IN [1543985988] unbound[7346:0] info: response for poison2.brau.jp. A IN [1543985988] unbound[7346:0] info: reply from <brau.jp.> 14.192.44.5#53 [1543985988] unbound[7346:0] info: query response was ANSWER