Services: Unbound DNS: Blocklist - CNAME and A record on query fix

[thojo0]

With the current zone settings, Unbound returns both, the A and CNAME (to it self) record on different safe search subdomains.

Affected subdomains:

• safe.duckduckgo.com
• strict.bing.com
• safesearch.pixabay.com
• safeapi.qwant.com

This commit fixes this issue.
I also checked this on official documentations to be as accurate as possible, so nothing else breaks again.

[AdSchellevis]

I don't mind merging, but can you share the documentation that you are referring to?

[thojo0]

DuckDuckGo

https://duckduckgo.com/duckduckgo-help-pages/features/safe-search/

For network administrators, you can force strict safe search for everyone on your network by mapping duckduckgo.com to safe.duckduckgo.com. Mapping to safe.duckduckgo.com will guarantee that safe search is enabled for all DuckDuckGo queries on the network, and that client safe search controls are disabled.

Bing

https://support.microsoft.com/en-us/topic/blocking-adult-content-with-safesearch-or-blocking-chat-946059ed-992b-46a0-944a-28e8fb8f1814

At a network level, map www.bing.com to strict.bing.com.

Pixabay

https://pixabay.com/blog/posts/block-adult-content-on-pixabay-at-your-school-or-w-140/

Set the DNS entry for pixabay.com to be a CNAME for safesearch.pixabay.com.

Qwant

I didn't find an official docs/blog but because the same problem was there I used the same way like on the other ones.

[AdSchellevis]

but this doesn't explain why we are changing the redirect to transparent in

local-zone: "duckduckgo.com" transparent

[thojo0]

Ah sorry, I meant I checked the exact domains again.
the transparent zone I put there because of the CNAME+A record problem.

With the current zone settings, Unbound returns both, the A and CNAME (to it self) record on different safe search subdomains.

After some tests, this was the best solution to fix it and also the problem mentioned in #7301 without an explicit "whitelisting".

[wetono]

Since I can't access duckduckgo with safesearch enabled because of the problem you described (I'm using a Windows DNS server because of AD and have the OPNsense as the upstreams DNS, when the Windows DNS server caches the duckduckgo.com entry it only gives the client the safe.duckduckgo.com CNAME safe.duckduckgo.com and not the A-Record, so the client can't access duckduckgo), I'm glad to see there's a pull request that fixes this! I did some testing and have two small suggestions for improvement, but otherwise it works as intended!