Unbound DNS Resolver: Secure, Recursive DNS with Caching, Adblocking, and DNSSEC

Unbound is a powerful, secure, and high-performance recursive DNS resolver that provides privacy, security, and performance benefits over traditional DNS services. This comprehensive guide covers setting up Unbound with caching, basic network-level adblocking, DNSSEC validation, and performance optimization.

Table of Contents

Understanding Unbound DNS Resolver

Unbound is a validating, recursive, and caching DNS resolver that offers several advantages:

• Privacy: No third-party DNS queries, all resolution happens locally
• Security: DNSSEC validation to prevent DNS spoofing attacks
• Performance: Local caching reduces DNS lookup times
• Control: Network-level adblocking and custom DNS policies
• Flexibility: Custom configuration for advanced use cases

Prerequisites and System Requirements

System Requirements

# Minimum system requirements
# - 1 CPU core
# - 512MB RAM
# - 1GB disk space
# - Linux/Unix system (Ubuntu/Debian/CentOS recommended)

Required Dependencies

# Update system packages
sudo apt update && sudo apt upgrade -y

# Install required dependencies
sudo apt install -y build-essential libssl-dev libevent-dev

Installing Unbound DNS Resolver

Installation Methods

1. Package Manager Installation (Recommended)

# Ubuntu/Debian
sudo apt install -y unbound

# CentOS/RHEL
sudo yum install -y unbound

# Arch Linux
sudo pacman -S unbound

2. Source Compilation (Latest Version)

# Download latest Unbound source
wget https://nlnetlabs.nl/downloads/unbound/unbound-latest.tar.gz
tar -xzf unbound-latest.tar.gz
cd unbound-*/

# Configure and compile
./configure --prefix=/usr --sysconfdir=/etc/unbound
make
sudo make install

# Create system user
sudo useradd -r -s /bin/false unbound

Basic Unbound Configuration

Initial Configuration Setup

# Create configuration directory
sudo mkdir -p /etc/unbound
sudo chown -R unbound:unbound /etc/unbound

# Generate basic configuration
sudo unbound-control-setup

# Create configuration file
sudo nano /etc/unbound/unbound.conf

Basic Configuration File

# /etc/unbound/unbound.conf
server:
    # Interface configuration
    interface: 0.0.0.0
    interface: ::0
    port: 53
    access-control: 127.0.0.1/32 allow
    access-control: 192.168.1.0/24 allow
    access-control: ::1/128 allow

    # Performance settings
    num-threads: 2
    outgoing-range: 4096
    msg-cache-size: 100m
    rrset-cache-size: 200m
    cache-min-ttl: 300
    cache-max-ttl: 86400

    # Security settings
    harden-glue: yes
    harden-dnssec-stripped: yes
    use-caps-for-id: yes
    prefetch: yes
    prefetch-key: yes

    # Privacy settings
    qname-minimisation: yes
    private-address: 192.168.0.0/16
    private-address: 10.0.0.0/8
    private-address: 172.16.0.0/12
    private-address: fd00::/8
    private-address: fe80::/10

# Remote control configuration
remote-control:
    control-enable: yes
    control-interface: 127.0.0.1
    control-port: 8953
    server-key-file: "/etc/unbound/unbound_server.key"
    server-cert-file: "/etc/unbound/unbound_server.pem"
    control-key-file: "/etc/unbound/unbound_control.key"
    control-cert-file: "/etc/unbound/unbound_control.pem"

DNSSEC Configuration

Enabling DNSSEC Validation

# Add to unbound.conf server section
server:
    # DNSSEC validation
    module-config: "validator iterator"
    auto-trust-anchor-file: "/var/lib/unbound/root.key"
    val-clean-additional: yes
    val-permissive-mode: no
    val-log-level: 2

DNSSEC Setup Commands

# Download root DNSSEC key
sudo wget -O /var/lib/unbound/root.key https://www.internic.net/domain/named.root

# Set proper permissions
sudo chown unbound:unbound /var/lib/unbound/root.key
sudo chmod 644 /var/lib/unbound/root.key

# Create directory for DNSSEC keys
sudo mkdir -p /var/lib/unbound
sudo chown -R unbound:unbound /var/lib/unbound

Performance Optimization

Caching Configuration

# Optimized caching settings
server:
    # Cache sizes (adjust based on available memory)
    msg-cache-size: 256m
    rrset-cache-size: 512m
    infra-cache-size: 128m

    # Cache TTL settings
    cache-min-ttl: 60
    cache-max-ttl: 86400
    cache-max-negative-ttl: 3600

    # Prefetching
    prefetch: yes
    prefetch-key: yes

Threading and Network Settings

# Performance tuning
server:
    # Thread configuration
    num-threads: 4
    outgoing-range: 8192
    incoming-num-tcp: 10
    outgoing-num-tcp: 10

    # Network settings
    so-rcvbuf: 4m
    so-sndbuf: 4m
    so-reuseport: yes
    ip-transparent: yes

Network-Level Adblocking

Blocklist Configuration

# Create blocklist directory
sudo mkdir -p /etc/unbound/blocklists
sudo chown -R unbound:unbound /etc/unbound/blocklists

# Download popular blocklists
sudo wget -O /etc/unbound/blocklists/ads.txt https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
sudo wget -O /etc/unbound/blocklists/malware.txt https://raw.githubusercontent.com/mitchellkrogza/Phishing.Database/master/phishing-links-NEW-today.txt

# Process blocklists
sudo sed -i 's/0.0.0.0 //g' /etc/unbound/blocklists/*.txt
sudo sed -i 's/127.0.0.1 //g' /etc/unbound/blocklists/*.txt
sudo sed -i 's/#.*//g' /etc/unbound/blocklists/*.txt

Unbound Blocklist Integration

# Add to unbound.conf server section
server:
    # Local zone for adblocking
    local-zone: "doubleclick.net" redirect
    local-data: "doubleclick.net A 0.0.0.0"

    # Include blocklist files
    include: /etc/unbound/blocklists/ads.conf
    include: /etc/unbound/blocklists/malware.conf

# Generate blocklist configuration
sudo python3 -c "
import glob
domains = set()
for file in glob.glob('/etc/unbound/blocklists/*.txt'):
    with open(file) as f:
        for line in f:
            domain = line.strip()
            if domain and not domain.startswith('#'):
                domains.add(domain)

with open('/etc/unbound/blocklists/ads.conf', 'w') as f:
    for domain in sorted(domains):
        f.write(f'local-zone: \"{domain}\" redirect\n')
        f.write(f'local-data: \"{domain} A 0.0.0.0\"\n')
        f.write(f'local-data: \"{domain} AAAA ::\"\n')
"

Unbound Service Management

Starting and Enabling Unbound

# Start Unbound service
sudo systemctl start unbound

# Enable auto-start
sudo systemctl enable unbound

# Check service status
sudo systemctl status unbound

# Verify Unbound is running
sudo netstat -tulnp | grep unbound

Unbound Control Commands

# Check Unbound status
sudo unbound-control status

# Reload configuration
sudo unbound-control reload

# Flush cache
sudo unbound-control flush_zone .

# View statistics
sudo unbound-control stats

Testing and Validation

DNS Query Testing

# Test DNS resolution
dig @localhost example.com
dig @localhost google.com +dnssec

# Test DNSSEC validation
delv @localhost example.com

Performance Testing

# Benchmark DNS performance
dnseval -s localhost -q 1000 -f domains.txt

# Test cache effectiveness
dig @localhost google.com
dig @localhost google.com  # Should be faster (cached)

Advanced Configuration

Forward Zones

# Forward specific domains to other resolvers
forward-zone:
    name: "example.com"
    forward-addr: 1.1.1.1
    forward-addr: 8.8.8.8

Stub Zones

# Stub zones for internal networks
stub-zone:
    name: "internal.example.com"
    stub-addr: 192.168.1.10

View Configuration

# Create custom views for different networks
view:
    name: "internal-view"
    local-zone: "internal.example.com" transparent
    access-control: 192.168.1.0/24 allow

Monitoring and Maintenance

Log Configuration

# Logging settings
server:
    verbosity: 2
    use-syslog: yes
    logfile: "/var/log/unbound/unbound.log"
    log-queries: no
    log-replies: no
    log-local-actions: yes
    log-servfail: yes

Log Rotation

# Create logrotate configuration
sudo nano /etc/logrotate.d/unbound

# Add logrotate configuration
/var/log/unbound/*.log {
    daily
    missingok
    rotate 7
    compress
    delaycompress
    notifempty
    create 640 unbound unbound
    postrotate
        /bin/kill -HUP `cat /var/run/unbound.pid 2>/dev/null` 2>/dev/null || true
    endscript
}

Security Hardening

Firewall Configuration

# Configure firewall for Unbound
sudo ufw allow 53/tcp
sudo ufw allow 53/udp
sudo ufw allow from 192.168.1.0/24 to any port 53

# Restrict access to control interface
sudo ufw allow from 127.0.0.1 to any port 8953

Unbound Security Settings

# Security hardening
server:
    # Prevent amplification attacks
    rate-limit: 1000
    rate-limit-factor: 10

    # Prevent cache poisoning
    harden-below-nxdomain: yes
    harden-referral-path: yes

    # Privacy protection
    hide-identity: yes
    hide-version: yes
    identity: ""
    version: ""

Troubleshooting Common Issues

Connection Problems

# Check Unbound logs
sudo tail -f /var/log/unbound/unbound.log

# Test port availability
sudo netstat -tulnp | grep :53
sudo ss -tulnp | grep :53

# Check firewall rules
sudo ufw status

DNS Resolution Issues

# Test basic DNS resolution
dig @localhost example.com

# Check DNSSEC validation
delv @localhost example.com

# Test with different query types
dig @localhost example.com A
dig @localhost example.com AAAA
dig @localhost example.com MX

Migration from Other DNS Servers

From BIND to Unbound

# Export zones from BIND
named-checkzone example.com /var/named/example.com.zone

# Convert to Unbound format
# Manual conversion required for local zones

From dnsmasq to Unbound

# Backup dnsmasq configuration
sudo cp /etc/dnsmasq.conf /etc/dnsmasq.conf.backup

# Convert common settings
# - dnsmasq server= becomes forward-zone in Unbound
# - dnsmasq address=/ becomes local-zone in Unbound

Performance Comparison

Conclusion

Unbound provides a powerful, secure, and high-performance DNS resolution solution with comprehensive features like DNSSEC validation, advanced caching, and network-level adblocking. By following this guide, you can set up a robust DNS infrastructure that improves privacy, security, and performance for your network.

The combination of recursive resolution, DNSSEC validation, and adblocking makes Unbound an excellent choice for both personal and enterprise use. Regular monitoring, maintenance, and security updates will ensure your DNS resolver remains reliable and secure.

Ready to improve your DNS infrastructure? Start with the basic Unbound installation and gradually implement the advanced features like DNSSEC and adblocking. The performance and privacy benefits will be immediately noticeable.

What’s your experience with Unbound or other DNS resolvers? Share your configuration tips, performance benchmarks, and security insights in the comments below. The DNS community benefits from shared knowledge and real-world implementation experiences!