Unbound
A recursive, DNSSEC-validating DNS resolver. It looks names up by asking the internet's DNS servers directly, so no single company sees your whole browsing history.
#What it is
Most home networks send every DNS question to one big resolver: the ISP's, Google's (8.8.8.8) or Cloudflare's (1.1.1.1). That's a forwarding setup, and that one company sees every name every device looks up.
Unbound, from NLnet Labs, is a recursive resolver. Instead of asking someone else, it does the lookup itself: it asks the root servers who handles .com, asks them who handles example.com, then asks that domain's own authoritative server for the answer. Then it caches the result.
In my setup, Pi-hole filters first and hands everything it allows to Unbound, listening only on 127.0.0.1 port 5335.
#Why I use it
- Privacy by distribution. No single upstream sees all my queries. Each authoritative server only sees the questions about its own domains.
- DNSSEC validation. Unbound checks cryptographic signatures and refuses tampered answers.
- No dependency on a DNS provider. If a big public resolver has a bad day, I don't.
- Caching and prefetch. Popular names are refreshed before they expire, so repeat lookups are near-instant.
#Myth-buster
Unbound caches DNS answers, not web pages. It won't give you "internet without internet". With serve-expired on, it will keep answering from cache for a while if upstream is briefly unreachable, which is a nice bit of resilience.
#Trade-offs
- Queries still travel unencrypted. Recursive lookups to root and authoritative servers are plain DNS, so your ISP can still see them on the wire if it looks. What you gain is that no single resolver company gets a neat log of everything. If hiding queries from your ISP matters more to you, forward over DNS-over-TLS to a provider you trust instead; that swaps one trade-off for another.
- Cold cache is slower. The first lookup of a name walks the whole chain, sometimes taking a second.
#Gotchas I hit
- The very first
digcan time out on a fresh install while Unbound walks from the root with an empty cache. Retry. - Debian's
unbound-resolvconfhelper tries to route the system's own DNS through Unbound. Disable it so it doesn't fight Pi-hole. - It may fail to start on port 53 right after install, because Pi-hole wants that port. That's expected: move Unbound to
5335. - The
private-addresslines are DNS rebinding protection: a public name is never allowed to resolve to a private IP on your LAN.