Unbound integration

Unbound is a DNS resolver that can be integrated with Pi-hole as an alternative to using upstream DNS servers.

Unbound is a validating, recursive, and caching DNS resolver. When used with Pi-hole, instead of forwarding DNS queries to upstream servers like Google or Cloudflare, Pi-hole sends queries to Unbound which then handles the entire DNS resolution process itself.

Here's how it works:

1. When you make a DNS query (like visiting www.example.com), Unbound starts at the root DNS servers
2. It then recursively queries the authoritative servers for each part of the domain (.com, then example.com)
3. It validates DNSSEC signatures along the way to ensure the responses are authentic
4. It caches the results to speed up future queries

Key benefits of using Unbound with Pi-hole:

• Enhanced privacy: Your DNS queries aren't sent to third-party DNS providers
• Better security: Full DNSSEC validation
• Reduced latency: Caching of results improves response times
• Complete control: You're running your own resolver rather than relying on external services

The main trade-off is that initial DNS queries might be slightly slower since Unbound has to perform the full resolution process rather than just forwarding to a fast upstream server. However, this is typically offset by the caching benefits for frequently accessed domains.

Setting up Unbound with Pi-hole.

Here are the step-by-step instructions:

1. First, install Unbound:

sudo apt install unbound

1. Create a configuration file for Unbound:

sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf

1. Add this configuration to the file:

server:
    # Listen on all interfaces on port 5335
    interface: 0.0.0.0
    port: 5335

    # Enable IPv4 and IPv6
    do-ip4: yes
    do-ip6: yes

    # Enable UDP and TCP
    do-udp: yes
    do-tcp: yes

    # Use this machine as the only nameserver
    do-not-query-localhost: no

    # Basic security settings
    hide-identity: yes
    hide-version: yes

    # Limit cache size
    msg-cache-size: 128m
    rrset-cache-size: 256m

    # Ensure kernel buffer is large enough
    so-rcvbuf: 1m

    # Ensure privacy of local IP ranges
    private-address: 192.168.0.0/16
    private-address: 169.254.0.0/16
    private-address: 172.16.0.0/12
    private-address: 10.0.0.0/8

    # Use DNSSEC
    harden-glue: yes
    harden-dnssec-stripped: yes
    use-caps-for-id: no

    # Basic optimization
    prefetch: yes
    num-threads: 1
    so-reuseport: yes

1. Start and test Unbound:

sudo service unbound restart
dig pi-hole.net @127.0.0.1 -p 5335

1. Configure Pi-hole to use Unbound:

• Go to Pi-hole admin interface
• Navigate to Settings → DNS
• Uncheck all upstream DNS servers
• Add 127.0.0.1#5335 as a custom upstream DNS server
• Save the changes

1. Verify the setup:

pihole -d

Key points to remember:

• Unbound runs on port 5335 to avoid conflicts with Pi-hole
• Initial DNS queries might be slower but will improve with caching
• The configuration includes DNSSEC validation for better security
• The setup provides complete DNS resolution independence