# HG changeset patch
# User IBBoard <dev@ibboard.co.uk>
# Date 1601666164 -3600
# Node ID 78a9c59461545ec859ef7303cd38f05436538e79
# Parent  85d2c0079af9c8fd056af61dc3641fc941bbd160
Handle DNS64 locally to fix DNSSEC issues

Unbound passes a "DO" (DNSSEC Okay) flag to upstream servers,
which means they don't synthesise DNS64 entries correctly for
some domains.

Doing this loses us redundancy (if :82: goes down we're DNS-less
until a manual change) but at least we can resolve more DNS now

diff -r 85d2c0079af9 -r 78a9c5946154 common/unbound.conf-ibbvps
--- a/common/unbound.conf-ibbvps	Sun Sep 27 12:59:34 2020 +0100
+++ b/common/unbound.conf-ibbvps	Fri Oct 02 20:16:04 2020 +0100
@@ -5,6 +5,8 @@
 	access-control: 127.0.0.0/24 allow
 	access-control: ::1 allow
         verbosity: 1
+        module-config: "dns64 validator iterator"
+        dns64-prefix: 2a00:1098:0:82:1000:3a::/96
 
 forward-zone:
         name: "."