Unbound - Revision history

Glueless: Resolving issues with example config

2026-03-30T03:50:43Z

Resolving issues with example config

← Older revision		Revision as of 03:50, 30 March 2026
Line 37:		Line 37:
	interface = [ "192.168.1.2" ];		interface = [ "192.168.1.2" ];
	# IPs allowed to query		# IPs allowed to query
	access-control = [ "192.168.1.0/24" ~~allow~~ ];		access-control = [ "192.168.1.0/24 allow" ];
	# Enable RPZ		# Enable RPZ
	module.config = "'respip validator iterator'";		module-config = "'respip validator iterator'";
	};		};

Line 45:		Line 45:
	name = "hageziPro";		name = "hageziPro";
	url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/pro.txt";		url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/pro.txt";
	}]		}];

	settings.forward-zone = [{		settings.forward-zone = [{
Line 51:		Line 51:
	forward-tls-upstream = true;		forward-tls-upstream = true;
	forward-addr = [		forward-addr = [
	"9.9.9.9@853#dns.quad9.net";		"9.9.9.9@853#dns.quad9.net"
	"149.112.112.112@853#dns.quad9.net"		"149.112.112.112@853#dns.quad9.net"
	"1.1.1.1@853#cloudflare-dns.com";		"1.1.1.1@853#cloudflare-dns.com"
	"1.0.0.1@853#cloudflare-dns.com";		"1.0.0.1@853#cloudflare-dns.com"
	]		];
	}];		}];
	};		};

J8: Silly of me

2026-03-24T14:17:16Z

Silly of me

← Older revision		Revision as of 14:17, 24 March 2026
Line 27:		Line 27:
	== DNS forwarder with blocklists ==		== DNS forwarder with blocklists ==

	In this configuration we are using DoT to reach Quad9 and Cloudflare public DNS resolvers, in addition, we are filtering the results with a list that blocks adds and improves privacy and security ~~and privacy~~ (as Pi-hole does).		In this configuration we are using DoT to reach Quad9 and Cloudflare public DNS resolvers, in addition, we are filtering the results with a list that blocks adds and improves privacy and security (as Pi-hole does).

	<syntaxhighlight lang="nixos">		<syntaxhighlight lang="nixos">

J8: Style correction

2026-03-24T14:15:36Z

Style correction

← Older revision		Revision as of 14:15, 24 March 2026
Line 5:		Line 5:
	== Minimal configuration. DNS resolver ==		== Minimal configuration. DNS resolver ==

	In this case our DNS queries are not encrypted upstream because the root servers do not support DNS-over-TLS (DoT) or DNS-over-HTTPS (DoH).		In this case our DNS queries are not encrypted upstream because the internet root name servers do not support DNS-over-TLS (DoT) or DNS-over-HTTPS (DoH).

	<syntaxhighlight lang="nixos">		<syntaxhighlight lang="nixos">
Line 27:		Line 27:
	== DNS forwarder with blocklists ==		== DNS forwarder with blocklists ==

	In this configuration we are using DoT to Quad9 and Cloudflare public DNS resolvers, ~~plus~~, we are ~~applying an Ad blocker~~ list (as Pi-hole does).		In this configuration we are using DoT to reach Quad9 and Cloudflare public DNS resolvers, in addition, we are filtering the results with a list that blocks adds and improves privacy and security and privacy (as Pi-hole does).

	<syntaxhighlight lang="nixos">		<syntaxhighlight lang="nixos">

J8: Typo

2026-03-24T11:29:38Z

Typo

← Older revision		Revision as of 11:29, 24 March 2026
Line 10:		Line 10:
	services.unbound = {		services.unbound = {
	enable = true;		enable = true;
	# ~~nex~~ line is optional (RFC7816)		# next line is optional (RFC7816)
	settings.server.qname-minimisation = true;		settings.server.qname-minimisation = true;
	};		};

J8: Correcting typos, improving explanations and adding options

2026-03-24T11:27:28Z

Correcting typos, improving explanations and adding options

← Older revision		Revision as of 11:27, 24 March 2026
Line 5:		Line 5:
	== Minimal configuration. DNS resolver ==		== Minimal configuration. DNS resolver ==

	In this case our DNS queries ~~upstream~~ are not encrypted.		In this case our DNS queries are not encrypted upstream because the root servers do not support DNS-over-TLS (DoT) or DNS-over-HTTPS (DoH).

	<syntaxhighlight lang="nixos">		<syntaxhighlight lang="nixos">
	services.unbound = {		services.unbound = {
	enable = true;		enable = true;
	settings.server.qname-minimisation = true; ~~# optional~~		# nex line is optional (RFC7816)
			settings.server.qname-minimisation = true;
	};		};
	</syntaxhighlight>		</syntaxhighlight>
Line 17:		Line 18:

	<syntaxhighlight>		<syntaxhighlight>
			$ nslookup nixos.org localhost
	$ systemctl status unbound.service		$ systemctl status unbound.service
	$ ~~nslookup nixos~~.~~org localhost~~		$ cat /etc/unbound/unbound.conf
	</syntaxhighlight>		</syntaxhighlight>

			If during the configuration our computer stops resolving DNS and we lose connectivity, we can manually set the line <code>nameserver 9.9.9.9</code> doing <code>sudo nano /etc/resolv.conf</code>. Now we can rebuild our system.

	== DNS forwarder with blocklists ==		== DNS forwarder with blocklists ==

	In this ~~case~~ we are using ~~DoH~~ to Quad9 and Cloudflare public DNS resolvers ~~and filtering with a blocklist~~ as Pi-~~Hole~~ does.		In this configuration we are using DoT to Quad9 and Cloudflare public DNS resolvers, plus, we are applying an Ad blocker list (as Pi-hole does).

	<syntaxhighlight lang="nixos">		<syntaxhighlight lang="nixos">
	services.unbound = {		services.unbound = {
	enable = true;		enable = true;

	settings.server.module.config = "'respip validator iterator'"; ~~# RPZ~~		settings.server = {
			# Our Unbound server IP
			interface = [ "192.168.1.2" ];
			# IPs allowed to query
			access-control = [ "192.168.1.0/24" allow ];
			# Enable RPZ
			module.config = "'respip validator iterator'";
			};

	settings.rpz = [{		settings.rpz = [{
	name = "~~blocklist_hageziPro~~";		name = "hageziPro";
	url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/pro.txt";		url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/pro.txt";
	}]		}]

	settings.forward-zone = [{		settings.forward-zone = [{
	name = ".";		name = ".";
	forward-tls-upstream = true;		forward-tls-upstream = true;
	forward-addr = [		forward-addr = [
	"9.9.9.9@853#dns.quad9.net";		"9.9.9.9@853#dns.quad9.net";
	"149.112.112.112@853#dns.quad9.net"		"149.112.112.112@853#dns.quad9.net"
	"1.1.1.1@853#cloudflare-dns.com";		"1.1.1.1@853#cloudflare-dns.com";
	"1.0.0.1@853#cloudflare-dns.com";		"1.0.0.1@853#cloudflare-dns.com";
	]		]
	}];		}];
	};		};
	</syntaxhighlight>		</syntaxhighlight>

J8: DNS resolver and DNS forwarder with a blocklist

2026-03-23T22:34:52Z

DNS resolver and DNS forwarder with a blocklist

← Older revision		Revision as of 22:34, 23 March 2026
Line 3:		Line 3:
	Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards.		Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards.

	== Minimal configuration ==		== Minimal configuration. DNS resolver ==

			In this case our DNS queries upstream are not encrypted.

	<syntaxhighlight lang="nixos">		<syntaxhighlight lang="nixos">
	services.unbound = {		services.unbound = {
Line 18:		Line 21:
	</syntaxhighlight>		</syntaxhighlight>

	== ~~Example configuration~~ ==		== DNS forwarder with blocklists ==

			In this case we are using DoH to Quad9 and Cloudflare public DNS resolvers and filtering with a blocklist as Pi-Hole does.

	<syntaxhighlight lang="nixos">		<syntaxhighlight lang="nixos">
	services.unbound = {		services.unbound = {
	enable = true;		enable = true;
	settings ~~= {~~
	server = {		settings.server.module.config = "'respip validator iterator'"; # RPZ
	~~# When only using Unbound as DNS, make sure to replace 127.0.0.1 with your ip address~~
	~~# When using Unbound in combination with pi-hole or Adguard, leave 127~~.~~0.0.1, and point Adguard to 127.0.0.1:PORT~~		settings.rpz = [{
	~~interface~~ = [ "~~127.0.0.1~~" ];		name = "blocklist_hageziPro";
	~~port~~ = ~~5335;~~		url = "https://cdn.jsdelivr.net/gh/hagezi/dns-blocklists@latest/rpz/pro.txt";
	~~access-control = [~~ "~~127~~.0.0.~~1 allow~~" ];		}]
	~~# See `man unbound.conf`~~
	~~prefetch = true;~~		settings.forward-zone = [{
	~~hide-identity = true;~~		name = ".";
	~~hide-version = true;~~		forward-tls-upstream = true;
	};		forward-addr = [
	forward-zone = [		"9.9.9.9@853#dns.quad9.net";
	~~# Example config with quad9~~		"149.112.112.112@853#dns.quad9.net"
	{		"1.1.1.1@853#cloudflare-dns.com";
	name = ".";		"1.0.0.1@853#cloudflare-dns.com";
	forward-tls-upstream = true; ~~# Protected DNS~~		]
	forward-addr = [		}];
	"9.9.9.9#dns.quad9.net"		};
	"149.112.112.112#dns.quad9.net"
	];
	}
	];
	};
	};
	</syntaxhighlight>		</syntaxhighlight>

J8: add minimal configuration

2026-03-23T21:11:30Z

add minimal configuration

← Older revision		Revision as of 21:11, 23 March 2026
Line 2:		Line 2:

	Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards.		Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards.

			== Minimal configuration ==
			<syntaxhighlight lang="nixos">
			services.unbound = {
			enable = true;
			settings.server.qname-minimisation = true; # optional
			};
			</syntaxhighlight>

			Test if it's working

			<syntaxhighlight>
			$ systemctl status unbound.service
			$ nslookup nixos.org localhost
			</syntaxhighlight>

	== Example configuration ==		== Example configuration ==

J7: forward-tls-upstream = true; # Protected DNS

2026-03-02T21:32:56Z

forward-tls-upstream = true; # Protected DNS

← Older revision		Revision as of 21:32, 2 March 2026
Line 23:		Line 23:
	{		{
	name = ".";		name = ".";
			forward-tls-upstream = true; # Protected DNS
	forward-addr = [		forward-addr = [
	"9.9.9.9#dns.quad9.net"		"9.9.9.9#dns.quad9.net"
	"149.112.112.112#dns.quad9.net"		"149.112.112.112#dns.quad9.net"
	];		];
	~~forward-tls-upstream = true; # Protected DNS~~
	}		}
	];		];

J7: Removed options equal to default values to clean the code

2026-03-02T21:31:07Z

Removed options equal to default values to clean the code

← Older revision		Revision as of 21:31, 2 March 2026
Line 14:		Line 14:
	port = 5335;		port = 5335;
	access-control = [ "127.0.0.1 allow" ];		access-control = [ "127.0.0.1 allow" ];
	# ~~Based on recommended settings in https://docs.pi-hole~~.~~net/guides/dns/unbound/#configure-unbound~~		# See `man unbound.conf`
	~~harden-glue = true;~~
	~~harden-dnssec-stripped = true;~~
	~~use-caps-for-id = false;~~
	prefetch = true;		prefetch = true;
	~~edns-buffer-size = 1232;~~

	~~# Custom settings~~
	hide-identity = true;		hide-identity = true;
	hide-version = true;		hide-version = true;

Klinger: Moved link from references to top

2025-03-20T16:35:01Z

Moved link from references to top

← Older revision		Revision as of 16:35, 20 March 2025
Line 1:		Line 1:
	~~{{Expansion}}~~		[https://www.nlnetlabs.nl/projects/unbound/about/ Unbound] is a DNS server. Quoting the official project page:
	Unbound is a DNS server. Quoting the official project page:

	Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards.~~<ref>https://www.nlnetlabs.nl/projects/unbound/about/</ref>~~		Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards.

	== Example configuration ==		== Example configuration ==
Line 46:		Line 45:
	* https://unbound.docs.nlnetlabs.nl/en/latest/		* https://unbound.docs.nlnetlabs.nl/en/latest/
	* [https://wiki.archlinux.org/title/Unbound ArchWiki page]		* [https://wiki.archlinux.org/title/Unbound ArchWiki page]

	~~== References ==~~
	[[Category:Networking]]		[[Category:Networking]]
	[[Category:Server]]		[[Category:Server]]
	[[Category:DNS]]		[[Category:DNS]]