Setting up unbound DNS server - Revision history

Prabuanand: added Pi-hole wikilink

2025-11-03T07:55:33Z

added Pi-hole wikilink

← Older revision		Revision as of 07:55, 3 November 2025
Line 107:		Line 107:
	* [https://unbound.docs.nlnetlabs.nl/en/latest/ Official website]		* [https://unbound.docs.nlnetlabs.nl/en/latest/ Official website]
	* [[Using Unbound as an Ad-blocker]]		* [[Using Unbound as an Ad-blocker]]
			* [[Using Pi-hole with Unbound]]
	* [https://linux.die.net/man/5/unbound.conf unbound.conf man page]		* [https://linux.die.net/man/5/unbound.conf unbound.conf man page]
	* [https://web.archive.org/web/20180508133447/https://unbound.net/documentation/howto_optimise.html unbound optimization guide]		* [https://web.archive.org/web/20180508133447/https://unbound.net/documentation/howto_optimise.html unbound optimization guide]

Prabuanand: changed heading

2025-11-03T07:22:11Z

changed heading

← Older revision		Revision as of 07:22, 3 November 2025
Line 84:		Line 84:
	Grab the latest root hints file using wget and place it the at {{Path\|/etc/unbound/root.hints}} as follows: {{Cmd\|# wget -S https://www.internic.net/domain/named.cache -O /etc/unbound/root.hints}}		Grab the latest root hints file using wget and place it the at {{Path\|/etc/unbound/root.hints}} as follows: {{Cmd\|# wget -S https://www.internic.net/domain/named.cache -O /etc/unbound/root.hints}}

	=== ~~Configure~~ root hints ===		=== Enable root hints ===

	Point unbound to the root hints file by adding the following line to the server section of the unbound config file:		Point unbound to the root hints file by adding the following line to the server section of the unbound config file:

Prabuanand: added headings

2025-11-03T07:12:16Z

added headings

@@ Line 59: / Line 59: @@
 </nowiki>
 }}
 == Service management ==
@@ Line 96: / Line 75: @@
 or:
 use {{ic|drill}} command from the {{Pkg|drill}} package: {{Cmd|$ drill www.bbc.co.uk @10.0.0.1}}
 == See also ==

Prabuanand: cleaned up formatting. no content changed

2025-11-03T05:38:59Z

cleaned up formatting. no content changed

← Older revision		Revision as of 05:38, 3 November 2025
Line 1:		Line 1:
	[https://nlnetlabs.nl/projects/unbound/about/ Unbound] is a validating, recursive, and caching DNS resolver that supports DNSSEC.		[https://nlnetlabs.nl/projects/unbound/about/ Unbound] is a validating, recursive, and caching DNS resolver that supports DNSSEC.

	= ~~Install~~ =		== Installation ==

	Install the {{Pkg\|unbound}} package:		Install the {{Pkg\|unbound}} package: {{Cmd\|# apk add unbound}}
	{{Cmd\|apk add unbound}}

	= ~~Setup~~ =		== Configuration ==

	~~<code>unbound</code> can be set up to run as a service and started with:~~		The following configuration is an example of a caching name server (in a production server, it's recommended to adjust the access-control parameter to limit access to your network). The forward-zone(s) section will forward all DNS queries to the specified servers. Don't forget to change the 'interface' parameter to that of your local interface IP address (or 0.0.0.0 to listen on all local IPv4 interfaces). The following is a minimal example with many options commented out:{{Cat\|/etc/unbound/unbound.conf\|<nowiki>server:

	~~rc-update add unbound default~~
	~~service unbound start~~

	~~= Configure =~~

	The following configuration is an example of a caching name server (in a production server, it's recommended to adjust the access-control parameter to limit access to your network). The forward-zone(s) section will forward all DNS queries to the specified servers. Don't forget to change the 'interface' parameter to that of your local interface IP address (or 0.0.0.0 to listen on all local IPv4 interfaces). The following is a minimal example with many options commented out.

	{{~~Path~~\|/etc/unbound/unbound.conf}}
	<~~pre~~>
	server:
	verbosity: 1		verbosity: 1
	## Specify the interface address to listen on:		## Specify the interface address to listen on:
Line 69:		Line 57:
	forward-addr: 4.2.2.1		forward-addr: 4.2.2.1
	forward-addr: 4.2.2.4		forward-addr: 4.2.2.4
	</~~pre~~>		</nowiki>
			}}

			=== root-hints ===

	~~== root-hints ==~~
	Instead of forwarding queries to a public DNS server, you may prefer to query the root DNS servers. To do this, comment out the forwarding entries ("forward-zone" sections) in the config. Then, grab the latest root hints file using wget:		Instead of forwarding queries to a public DNS server, you may prefer to query the root DNS servers. To do this, comment out the forwarding entries ("forward-zone" sections) in the config. Then, grab the latest root hints file using wget:
	{{Cmd\|wget -S https://www.internic.net/domain/named.cache -O /etc/unbound/root.hints}}		{{Cmd\|# wget -S https://www.internic.net/domain/named.cache -O /etc/unbound/root.hints}}
	And finally point unbound to the root hints file by adding the following line to the server section of the unbound config file:		And finally point unbound to the root hints file by adding the following line to the server section of the unbound config file:
	<pre>		<pre>
Line 80:		Line 70:
	Restart unbound to ensure the changes take effect. You may wish to setup a [[Alpine_Linux:FAQ#Why_don't_my_cron_jobs_run?\|cron job]] to update the root hints file occasionally.		Restart unbound to ensure the changes take effect. You may wish to setup a [[Alpine_Linux:FAQ#Why_don't_my_cron_jobs_run?\|cron job]] to update the root hints file occasionally.

	== 0x20 bit ==		=== 0x20 bit ===

	Use of the [https://datatracker.ietf.org/doc/html/draft-vixie-dnsext-dns0x20-00.html 0x20 bit] is considered experimental. It makes use of an otherwise unused bit in a DNS packet to ask an authoritative server to respond with an answer mimicking the case used in the query.		Use of the [https://datatracker.ietf.org/doc/html/draft-vixie-dnsext-dns0x20-00.html 0x20 bit] is considered experimental. It makes use of an otherwise unused bit in a DNS packet to ask an authoritative server to respond with an answer mimicking the case used in the query.

Line 90:		Line 81:
	</pre>		</pre>

	= ~~Set auto-start, start and test the daemon~~ =		== Service management ==

	Check the configuration for errors:		Check the configuration file for errors:{{Cmd\|$ unbound-checkconf}}
	{{Cmd\|unbound-checkconf}}
	~~if no errors are reported, set to auto-start then start unbound:~~
	~~{{Cmd\|rc-update add unbound~~
	~~rc-service unbound start}}~~
	~~Test. For example:~~
	~~{{Cmd\|dig dl-cdn.alpinelinux.org @10.0.0.1}}~~
	~~or:~~
	~~{{Cmd\|nslookup www.google.cz 10.0.0.1}}~~
	~~or use {{Pkg\|drill}}:~~
	~~{{Cmd\|drill www.bbc.co.uk @10.0.0.1~~}}

	~~= Additional information =~~		If no errors are reported, add the {{ic\|unbound}} service to auto-start using [[OpenRC]]: {{Cmd\|# rc-update add unbound default}}
	unbound~~.conf man page~~ [~~https://linux.die.net/man/5/unbound.conf here~~] ~~or [https~~://unbound~~.docs.nlnetlabs.nl/en/latest/ here]~~

	[~~https://web.archive~~.~~org/web/20180508133447/https~~://unbound~~.net/documentation/howto_optimise.html unbound optimization guide]~~		{{ic\|unbound}} service can be managed using standard start\|stop\|restart [[OpenRC]] commands. To start the service immediately:{{Cmd\|# rc-service unbound start}}

	~~[https://calomel.org/unbound_dns.html excellent unbound tutorial at calomel.org]~~		== Testing ==

	~~General information via~~ the ~~Wikipedia pages on [https~~:~~//en~~.~~wikipedia~~.~~org/wiki/Domain_Name_System DNS], [https~~:~~//en~~.~~wikipedia~~.org~~/wiki/List_of_DNS_record_types record types], [https~~:~~//en~~.~~wikipedia~~.~~org/wiki/Dns_zone zones], [https://en~~.~~wikipedia~~.~~org/wiki/Name_server name servers] and [https://en~~.~~wikipedia~~.~~org/wiki/Dnssec DNSsec]~~		Test the working of DNS service as follows: {{Cmd\|$ nslookup www.google.cz 10.0.0.1}}
			or:
			use {{ic\|dig}} command from {{Pkg\|bind-tools}} package:{{Cmd\|$ dig dl-cdn.alpinelinux.org @10.0.0.1}}
			or:
			use {{ic\|drill}} command from the {{Pkg\|drill}} package: {{Cmd\|$ drill www.bbc.co.uk @10.0.0.1}}

	== See also ==		== See also ==

			* [https://unbound.docs.nlnetlabs.nl/en/latest/ Official website]
	* [[Using Unbound as an Ad-blocker]]		* [[Using Unbound as an Ad-blocker]]
			* [https://linux.die.net/man/5/unbound.conf unbound.conf man page]
			* [https://web.archive.org/web/20180508133447/https://unbound.net/documentation/howto_optimise.html unbound optimization guide]
			* [https://calomel.org/unbound_dns.html excellent unbound tutorial at calomel.org]
			* Wikipedia pages
			** [https://en.wikipedia.org/wiki/Domain_Name_System DNS]
			** [https://en.wikipedia.org/wiki/List_of_DNS_record_types record types]
			** [https://en.wikipedia.org/wiki/Dns_zone zones]
			** [https://en.wikipedia.org/wiki/Name_server name servers]
			** [https://en.wikipedia.org/wiki/Dnssec DNSsec]


	[[Category:Networking]]		[[Category:Networking]]

WhyNotHugo: See also: Using Unbound as an Ad-blocker

2024-07-07T09:07:57Z

See also: Using Unbound as an Ad-blocker

← Older revision		Revision as of 09:07, 7 July 2024
Line 112:		Line 112:

	General information via the Wikipedia pages on [https://en.wikipedia.org/wiki/Domain_Name_System DNS], [https://en.wikipedia.org/wiki/List_of_DNS_record_types record types], [https://en.wikipedia.org/wiki/Dns_zone zones], [https://en.wikipedia.org/wiki/Name_server name servers] and [https://en.wikipedia.org/wiki/Dnssec DNSsec]		General information via the Wikipedia pages on [https://en.wikipedia.org/wiki/Domain_Name_System DNS], [https://en.wikipedia.org/wiki/List_of_DNS_record_types record types], [https://en.wikipedia.org/wiki/Dns_zone zones], [https://en.wikipedia.org/wiki/Name_server name servers] and [https://en.wikipedia.org/wiki/Dnssec DNSsec]

			== See also ==

			* [[Using Unbound as an Ad-blocker]]

	[[Category:Networking]]		[[Category:Networking]]

WhyNotHugo: basic service usage

2024-03-15T13:51:34Z

basic service usage

← Older revision		Revision as of 13:51, 15 March 2024
Line 5:		Line 5:
	Install the {{Pkg\|unbound}} package:		Install the {{Pkg\|unbound}} package:
	{{Cmd\|apk add unbound}}		{{Cmd\|apk add unbound}}

			= Setup =

			<code>unbound</code> can be set up to run as a service and started with:

			rc-update add unbound default
			service unbound start

	= Configure =		= Configure =

Zcrayfish: /* Additional information */ Rescued a dead link using internet archive.

2023-12-21T11:20:35Z

Additional information: Rescued a dead link using internet archive.

← Older revision		Revision as of 11:20, 21 December 2023
Line 100:		Line 100:
	unbound.conf man page [https://linux.die.net/man/5/unbound.conf here] or [https://unbound.docs.nlnetlabs.nl/en/latest/ here]		unbound.conf man page [https://linux.die.net/man/5/unbound.conf here] or [https://unbound.docs.nlnetlabs.nl/en/latest/ here]

	[https://unbound.net/documentation/howto_optimise.html unbound optimization guide]~~{{dead link}}~~		[https://web.archive.org/web/20180508133447/https://unbound.net/documentation/howto_optimise.html unbound optimization guide]

	[https://calomel.org/unbound_dns.html excellent unbound tutorial at calomel.org]		[https://calomel.org/unbound_dns.html excellent unbound tutorial at calomel.org]

Sertonix: update links

2023-09-25T11:02:04Z

update links

← Older revision		Revision as of 11:02, 25 September 2023
Line 1:		Line 1:
	[https://unbound~~.net~~/ Unbound] is a validating, recursive, and caching DNS resolver that supports DNSSEC.		[https://nlnetlabs.nl/projects/unbound/about/ Unbound] is a validating, recursive, and caching DNS resolver that supports DNSSEC.

	= Install =		= Install =
Line 71:		Line 71:
	root-hints: "/etc/unbound/root.hints"		root-hints: "/etc/unbound/root.hints"
	</pre>		</pre>
	Restart unbound to ensure the changes take effect. You may wish to setup a [[FAQ#~~My cron jobs don.27t run.3F~~\|cron job]] to update the root hints file occasionally.		Restart unbound to ensure the changes take effect. You may wish to setup a [[Alpine_Linux:FAQ#Why_don't_my_cron_jobs_run?\|cron job]] to update the root hints file occasionally.

	== 0x20 bit ==		== 0x20 bit ==
Line 98:		Line 98:

	= Additional information =		= Additional information =
	unbound.conf man page [https://linux.die.net/man/5/unbound.conf here] or [https://unbound.~~net~~/~~documentation~~/~~unbound.conf.html~~ here]		unbound.conf man page [https://linux.die.net/man/5/unbound.conf here] or [https://unbound.docs.nlnetlabs.nl/en/latest/ here]

	[https://unbound.net/documentation/howto_optimise.html unbound optimization guide]		[https://unbound.net/documentation/howto_optimise.html unbound optimization guide]{{dead link}}

	[https://calomel.org/unbound_dns.html excellent unbound tutorial at calomel.org]		[https://calomel.org/unbound_dns.html excellent unbound tutorial at calomel.org]

Sertonix: update link

2023-08-25T11:41:50Z

update link

← Older revision		Revision as of 11:41, 25 August 2023
Line 74:		Line 74:

	== 0x20 bit ==		== 0x20 bit ==
	Use of the [https://~~tools~~.ietf.org/html/draft-vixie-dnsext-dns0x20-00.html 0x20 bit] is considered experimental. It makes use of an otherwise unused bit in a DNS packet to ask an authoritative server to respond with an answer mimicking the case used in the query.		Use of the [https://datatracker.ietf.org/doc/html/draft-vixie-dnsext-dns0x20-00.html 0x20 bit] is considered experimental. It makes use of an otherwise unused bit in a DNS packet to ask an authoritative server to respond with an answer mimicking the case used in the query.

	For example, when using this feature a query for www.google.com could appear in the request as www.google.com or Www.GoogLe.coM or WWW.GoOGlE.cOm or any other conbination of upper and lower case. The authoritative server should respond with the same case. This helps prevent DNS spoofing attacks.		For example, when using this feature a query for www.google.com could appear in the request as www.google.com or Www.GoogLe.coM or WWW.GoOGlE.cOm or any other conbination of upper and lower case. The authoritative server should respond with the same case. This helps prevent DNS spoofing attacks.

Zcrayfish: Removed typo in previous edit :) :) :)

2023-07-26T12:58:10Z

Removed typo in previous edit :) :) :)

← Older revision		Revision as of 12:58, 26 July 2023
Line 1:		Line 1:
	[~~httpss~~://unbound.net/ Unbound] is a validating, recursive, and caching DNS resolver that supports DNSSEC.		[https://unbound.net/ Unbound] is a validating, recursive, and caching DNS resolver that supports DNSSEC.

	= Install =		= Install =