I attempted to disable IPv6 lookups in unbound through these options:
do-ip6: no
prefer-ip6: no
Really prefer-ip6 should only take effect when do-ip6 is yes. In any case, I use tcpdump to dump the traffic and I still see IPv6 queries being issued to my forwarding server.
If I have disabled it, why is unbound still attempting to do IPv6? Is there another hidden option that is silently enabling it?
The do-ip6 setting stops unbound from sending or receiving DNS queries over IPv6. It does not stop unbound from talking about DNS IPv6 records over IPv4.
From the man page of unbound.conf (emphasis mine):
do-ip6: (yes or no)
Enable or disable whether ip6 queries are answered or issued. Default is yes. If disabled, queries are not answered on IPv6, and queries are not sent on IPv6 to the internet nameservers. With this option you can disable the ipv6 transport for sending DNS traffic, it does not impact the contents of the DNS traffic, which may have ip4 and ip6 addresses in it.
Likewise, the prefer-ip6 controls whether unbound prefers using IPv6 for talking to a DNS server that is reachable over both IPv4 and IPv6, or not.
To block reverse IPv6 queries, perhaps you could do something like this?
local-zone: ip6.arpa. refuse
Blocking forward queries about IPv6 addresses would require filtering out any queries about AAAA records. But a single query can include questions about several record types, and then the software would have to either strip away the IPv6-specific record types from the query, or to reject the entire query.
