Description
Using your ISP's resolver or a public one means someone learns every domain you visit, and a poisoned cache or tampered response can send your browser somewhere it should not go. Unbound takes that link back: run a validating recursive resolver on your own machine or router, query the root servers downward yourself instead of handing lookups to a third party, and verify DNSSEC signatures on every answer so forged records do not get through.
Maintained by NLnet Labs, it is the default resolver shipped by several Linux and BSD distributions and is embedded in a lot of router firmware. The design favors being fast and lean — a few lines of configuration bring up a usable local resolver, and a cache hit answers at local-machine latency. Beyond plain resolution it supports DNS-over-TLS and DNS-over-HTTPS for encrypted upstream queries, query name minimization, and local zone overrides.
BSD licensed, running on Linux, the BSDs, macOS and Windows.
Recursive resolution: queries proceed from the root servers down without depending on an ISP or public resolver, so your lookups no longer pass through someone else's logs.
DNSSEC validation: signature chains on incoming answers are verified, and tampered or forged records are discarded rather than passed to the client.
Encrypted upstream: DNS-over-TLS and DNS-over-HTTPS are supported, so forwarded queries are not sent in the clear.
Query name minimization: only the portion of a name a given server needs is sent upward, reducing what intermediate servers can collect.
Local caching: results are cached locally, so repeat lookups for the same domain answer effectively instantly.
Local zones and overrides: local zones can be defined and specific names pointed at chosen addresses, useful for internal resolution or blocking particular domains.
Simple configuration: common setups take only a handful of lines, with detailed user guides and tutorials from the project.
Cross-platform and open: BSD licensed, available for Linux, the BSDs, macOS and Windows, and packaged in most Linux and BSD repositories.
Maintained by NLnet Labs, it is the default resolver shipped by several Linux and BSD distributions and is embedded in a lot of router firmware. The design favors being fast and lean — a few lines of configuration bring up a usable local resolver, and a cache hit answers at local-machine latency. Beyond plain resolution it supports DNS-over-TLS and DNS-over-HTTPS for encrypted upstream queries, query name minimization, and local zone overrides.
BSD licensed, running on Linux, the BSDs, macOS and Windows.
Features
Recursive resolution: queries proceed from the root servers down without depending on an ISP or public resolver, so your lookups no longer pass through someone else's logs.
DNSSEC validation: signature chains on incoming answers are verified, and tampered or forged records are discarded rather than passed to the client.
Encrypted upstream: DNS-over-TLS and DNS-over-HTTPS are supported, so forwarded queries are not sent in the clear.
Query name minimization: only the portion of a name a given server needs is sent upward, reducing what intermediate servers can collect.
Local caching: results are cached locally, so repeat lookups for the same domain answer effectively instantly.
Local zones and overrides: local zones can be defined and specific names pointed at chosen addresses, useful for internal resolution or blocking particular domains.
Simple configuration: common setups take only a handful of lines, with detailed user guides and tutorials from the project.
Cross-platform and open: BSD licensed, available for Linux, the BSDs, macOS and Windows, and packaged in most Linux and BSD repositories.
