{"slug": "unbound", "name": "Unbound", "category": "networking", "category_name": "Networking and VPN", "description": "Open-source validating, recursive, caching DNS resolver developed by NLnet Labs.", "recommenders": 6, "commenters": 13, "warners": 0, "score": 6.949, "rising": 3.02, "first": "2025-11-10", "latest": "2026-10-22", "why": "HN commenters run it as their own recursive resolver at home, praising how easy it is to self-host and pairing it with blocklists or Pi-hole and AdGuard Home to filter ads and trackers.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 8, "neutral": 9, "compare": 0, "warn": 0}, "spark": [0, 1, 0, 1, 0, 0, 0, 2, 0, 0, 3, 1], "listed": true, "loved": ["Easy self-hosting", "DNS blocking"], "caveat": "Upstream TLS", "short_quote": "I have been running my own recursive DNS with Unbound for years and never thought it was a \"highly specialized undertaking.\"", "icon": true, "domain": "nlnetlabs.nl", "github_repo": null, "official_url": "https://nlnetlabs.nl/projects/unbound/about/", "pricing": "open source", "aliases": ["Unbound"], "verdict": [{"text": "HN commenters run it as their own recursive resolver at home", "cites": [{"id": 803216848, "item_id": 50201053, "url": "https://news.ycombinator.com/item?id=50201053", "by": "koyote", "date": "2026-10-22", "stance": "recommend", "quote": "I use unbound and have a similar question. Shouldn't we just encourage everyone to run their own resolvers (it's turnkey for the most part!)?", "excerpt": "> Does the fact I have written this resolver make me liable should it not block the domains they listed which may contain copyright infringing content? I use unbound and have a similar question. Shouldn't we just encourage everyone to run their own resolvers (it's turnkey for the most part!)? Will Sony/beIn start going after the root servers and enforce a global block?", "context": "", "use_case": "recursive DNS resolver", "switched_from": "", "story": "Quad9 to exit France"}, {"id": 793126992, "item_id": 49570437, "url": "https://news.ycombinator.com/item?id=49570437", "by": "drnick1", "date": "2026-09-04", "stance": "recommend", "quote": "I have been running my own recursive DNS with Unbound for years and never thought it was a \"highly specialized undertaking.\"", "excerpt": "> Running a privacy-focused public DNS service is a highly specialized undertaking This seems like an overstatement: I have been running my own recursive DNS with Unbound for years and never thought it was a \"highly specialized undertaking.\" It took perhaps a couple of hours to set up in the pre-AI age. I filter ads and trackers using an aggressive blacklist[0]. [0] https://github.com/hagezi/dns-blocklists", "context": "", "use_case": "self-hosted recursive DNS", "switched_from": "", "story": "Shutting down our public encrypted DNS"}, {"id": 779324048, "item_id": 48707753, "url": "https://news.ycombinator.com/item?id=48707753", "by": "TacticalCoder", "date": "2026-06-28", "stance": "recommend", "quote": "My old Pi 3 running unbound stays always on.", "excerpt": "> Random, but I don't understand why anyone would choose a \"block ads and trackers\" DNS server as a default. I use a \"block known malware and known porn sites\" and then, on top of that, I use gigantic blocklists blocking known ads and trackers. But then I've got a whitelist of allowed domains, which I updated on-the-go if that one site wife really needed wasn't working due to overzealous filtering. The reason is simp", "context": "Gen Xer running home DNS on a Pi 3", "use_case": "DNS blocking ads, trackers, malware", "switched_from": "", "story": "Choosing a Public DNS Resolver"}]}, {"text": ", praising how easy it is to self-host and pairing it with blocklists or Pi-hole and AdGuard Home to filter ads and trackers.", "cites": [{"id": 803216848, "item_id": 50201053, "url": "https://news.ycombinator.com/item?id=50201053", "by": "koyote", "date": "2026-10-22", "stance": "recommend", "quote": "I use unbound and have a similar question. Shouldn't we just encourage everyone to run their own resolvers (it's turnkey for the most part!)?", "excerpt": "> Does the fact I have written this resolver make me liable should it not block the domains they listed which may contain copyright infringing content? I use unbound and have a similar question. Shouldn't we just encourage everyone to run their own resolvers (it's turnkey for the most part!)? Will Sony/beIn start going after the root servers and enforce a global block?", "context": "", "use_case": "recursive DNS resolver", "switched_from": "", "story": "Quad9 to exit France"}, {"id": 793126992, "item_id": 49570437, "url": "https://news.ycombinator.com/item?id=49570437", "by": "drnick1", "date": "2026-09-04", "stance": "recommend", "quote": "I have been running my own recursive DNS with Unbound for years and never thought it was a \"highly specialized undertaking.\"", "excerpt": "> Running a privacy-focused public DNS service is a highly specialized undertaking This seems like an overstatement: I have been running my own recursive DNS with Unbound for years and never thought it was a \"highly specialized undertaking.\" It took perhaps a couple of hours to set up in the pre-AI age. I filter ads and trackers using an aggressive blacklist[0]. [0] https://github.com/hagezi/dns-blocklists", "context": "", "use_case": "self-hosted recursive DNS", "switched_from": "", "story": "Shutting down our public encrypted DNS"}, {"id": 796471169, "item_id": 49779448, "url": "https://news.ycombinator.com/item?id=49779448", "by": "anygivnthursday", "date": "2026-09-20", "stance": "recommend", "quote": "pihole or unbound also supports blocklists", "excerpt": "For a home network network pihole or unbound also supports blocklists (bundled with opnsense for example if you also want a firewall). For Android, I use Rethink with Hagezi blocklists, so they block also when I am on mobile data (it is vpn based).", "context": "", "use_case": "home network DNS blocking", "switched_from": "", "story": "ChatGPT now knows what you do on other websites via ad collector"}, {"id": 744266771, "item_id": 46516673, "url": "https://news.ycombinator.com/item?id=46516673", "by": "elashri", "date": "2026-01-06", "stance": "neutral", "quote": "I use this DNS server connected to unbound to act as recursive DNS", "excerpt": "I hate ads with all my heart. And I go out of my way to religiously block them. I employ DNS blocking (through my own adguard home server) on my whole network (I use this DNS server connected to unbound to act as recursive DNS on all devices even when I am outside home). I use ublock origin on Firefox browser (one of the forks that guts Firefox ads and privacy settings by default) and on my iPhone I use wipr + uBlock", "context": "", "use_case": "recursive DNS", "switched_from": "", "story": "Vienam Bans Unskippable Ads, Requires Skip Button to Appear After 5 Seconds"}, {"id": 738469809, "item_id": 46154363, "url": "https://news.ycombinator.com/item?id=46154363", "by": "harry8", "date": "2025-12-04", "stance": "neutral", "quote": "This: https://docs.pi-hole.net/guides/dns/unbound/  was stupidly simple", "excerpt": "I don't know about unbound's blocklists and stats or indeed much about unbound at all. This: https://docs.pi-hole.net/guides/dns/unbound/ was stupidly simple, pi-hole has a gui that I was already used to and it all works great. So I think about and study other things that need fixing/improving in my life instead. To flip it, why would I use unbound without pi-hole? What's the win I haven't seen (or even looked at or ", "context": "", "use_case": "DNS resolver with Pi-hole", "switched_from": "", "story": "Kea DHCP: Modern, open source DHCPv4 and DHCPv6 server"}]}, {"text": " Complaints are few: one commenter notes that encrypting upstream queries is limited because few authoritative servers support TLS", "cites": [{"id": 779255328, "item_id": 48703458, "url": "https://news.ycombinator.com/item?id=48703458", "by": "Bender", "date": "2026-06-27", "stance": "neutral", "quote": "I used to keep standby DoT Unbound servers around", "excerpt": "When all the authoritative servers support TLS I can enable TLS outbound but very few of them do at the moment. At some point someone is decrypting, turtles all the way down. I could of course just do DoT to another instance of Unbound somewhere else but I do not need to do that as my ISP does not care about my queries. I used to keep standby DoT Unbound servers around but I have never once seen a US ISP tinker with ", "context": "", "use_case": "DNS resolver", "switched_from": "", "story": "Choosing a Public DNS Resolver"}]}, {"text": ", and another asks what Unbound adds over using Pi-hole alone.", "cites": [{"id": 738469809, "item_id": 46154363, "url": "https://news.ycombinator.com/item?id=46154363", "by": "harry8", "date": "2025-12-04", "stance": "neutral", "quote": "This: https://docs.pi-hole.net/guides/dns/unbound/  was stupidly simple", "excerpt": "I don't know about unbound's blocklists and stats or indeed much about unbound at all. This: https://docs.pi-hole.net/guides/dns/unbound/ was stupidly simple, pi-hole has a gui that I was already used to and it all works great. So I think about and study other things that need fixing/improving in my life instead. To flip it, why would I use unbound without pi-hole? What's the win I haven't seen (or even looked at or ", "context": "", "use_case": "DNS resolver with Pi-hole", "switched_from": "", "story": "Kea DHCP: Modern, open source DHCPv4 and DHCPv6 server"}]}], "praise": [{"label": "Easy self-hosting", "summary": "Commenters describe running their own resolver as turnkey, taking minutes to a couple of hours to set up.", "quotes": [{"id": 803216848, "item_id": 50201053, "url": "https://news.ycombinator.com/item?id=50201053", "by": "koyote", "date": "2026-10-22", "stance": "recommend", "quote": "I use unbound and have a similar question. Shouldn't we just encourage everyone to run their own resolvers (it's turnkey for the most part!)?", "excerpt": "> Does the fact I have written this resolver make me liable should it not block the domains they listed which may contain copyright infringing content? I use unbound and have a similar question. Shouldn't we just encourage everyone to run their own resolvers (it's turnkey for the most part!)? Will Sony/beIn start going after the root servers and enforce a global block?", "context": "", "use_case": "recursive DNS resolver", "switched_from": "", "story": "Quad9 to exit France"}, {"id": 793126992, "item_id": 49570437, "url": "https://news.ycombinator.com/item?id=49570437", "by": "drnick1", "date": "2026-09-04", "stance": "recommend", "quote": "I have been running my own recursive DNS with Unbound for years and never thought it was a \"highly specialized undertaking.\"", "excerpt": "> Running a privacy-focused public DNS service is a highly specialized undertaking This seems like an overstatement: I have been running my own recursive DNS with Unbound for years and never thought it was a \"highly specialized undertaking.\" It took perhaps a couple of hours to set up in the pre-AI age. I filter ads and trackers using an aggressive blacklist[0]. [0] https://github.com/hagezi/dns-blocklists", "context": "", "use_case": "self-hosted recursive DNS", "switched_from": "", "story": "Shutting down our public encrypted DNS"}, {"id": 779250176, "item_id": 48703136, "url": "https://news.ycombinator.com/item?id=48703136", "by": "Bender", "date": "2026-06-27", "stance": "recommend", "quote": "I use Unbound locally as a DoH server.", "excerpt": "I use Unbound locally as a DoH server. The Alpine Linux Unbound package is compiled with libnghttp2, required for the built in DoH listener. That's more than enough to enable ECH [1]. I pre-cache all the domains I use hourly via cron. My ISP is not going to dork with my DNS requests and their employees are bigger deviants than I. If I ever started browsing the web from a phone I would just set up my own public DoH se", "context": "", "use_case": "local DoH server", "switched_from": "", "story": "Choosing a Public DNS Resolver"}]}, {"label": "DNS blocking", "summary": "Used with blocklists to filter ads, trackers, and phishing domains across a network.", "quotes": [{"id": 796471169, "item_id": 49779448, "url": "https://news.ycombinator.com/item?id=49779448", "by": "anygivnthursday", "date": "2026-09-20", "stance": "recommend", "quote": "pihole or unbound also supports blocklists", "excerpt": "For a home network network pihole or unbound also supports blocklists (bundled with opnsense for example if you also want a firewall). For Android, I use Rethink with Hagezi blocklists, so they block also when I am on mobile data (it is vpn based).", "context": "", "use_case": "home network DNS blocking", "switched_from": "", "story": "ChatGPT now knows what you do on other websites via ad collector"}, {"id": 793126992, "item_id": 49570437, "url": "https://news.ycombinator.com/item?id=49570437", "by": "drnick1", "date": "2026-09-04", "stance": "recommend", "quote": "I have been running my own recursive DNS with Unbound for years and never thought it was a \"highly specialized undertaking.\"", "excerpt": "> Running a privacy-focused public DNS service is a highly specialized undertaking This seems like an overstatement: I have been running my own recursive DNS with Unbound for years and never thought it was a \"highly specialized undertaking.\" It took perhaps a couple of hours to set up in the pre-AI age. I filter ads and trackers using an aggressive blacklist[0]. [0] https://github.com/hagezi/dns-blocklists", "context": "", "use_case": "self-hosted recursive DNS", "switched_from": "", "story": "Shutting down our public encrypted DNS"}, {"id": 793199425, "item_id": 49574964, "url": "https://news.ycombinator.com/item?id=49574964", "by": "TacticalCoder", "date": "2026-09-05", "stance": "recommend", "quote": "Then I also run my own DNS (unbound)", "excerpt": "Instead of CloudFlare's 1.1.1.1 I like CloudFlare's 1.1.1.3: it filters known porn and known malware sites. By now I expect many sites to be filtered out: too much crap out there. Then I also run my own DNS (unbound) and after seeing a warning from one of my banks about a phishing site where one letter differed in the domain name from the real bank's site, I went ballistic: I did generate hundreds of thousands (maybe", "context": "runs it on a Pi 3 for years", "use_case": "self-hosted DNS with blocking", "switched_from": "", "story": "An open DNS recursive service for free security and high privacy"}]}, {"label": "Encrypted DNS", "summary": "Serves DNS over HTTPS or DNS over TLS, including behind nginx with filtering of local IPs.", "quotes": [{"id": 779250176, "item_id": 48703136, "url": "https://news.ycombinator.com/item?id=48703136", "by": "Bender", "date": "2026-06-27", "stance": "recommend", "quote": "I use Unbound locally as a DoH server.", "excerpt": "I use Unbound locally as a DoH server. The Alpine Linux Unbound package is compiled with libnghttp2, required for the built in DoH listener. That's more than enough to enable ECH [1]. I pre-cache all the domains I use hourly via cron. My ISP is not going to dork with my DNS requests and their employees are bigger deviants than I. If I ever started browsing the web from a phone I would just set up my own public DoH se", "context": "", "use_case": "local DoH server", "switched_from": "", "story": "Choosing a Public DNS Resolver"}, {"id": 799951761, "item_id": 49996985, "url": "https://news.ycombinator.com/item?id=49996985", "by": "TheBozzCL", "date": "2026-10-07", "stance": "neutral", "quote": "Then nginx forwards the streams to Unbound, which filters out any local IPs from the responses to avoid leaks.", "excerpt": "I self-host my own DNS over TLS for domain-level adblocking. Maybe not the wisest decision, but it's working well so far and it doesn't require a lot of maintenance now that I've refined the setup. I use a DNS registrar and certificate that support wildcards. That way, I don't have to leak my DoT subdomain and I gain some obfuscation. Android's Private DNS option doesn't support alternate ports, so I'm forced to use ", "context": "self-hosts DNS over TLS", "use_case": "DNS resolver filtering local IPs", "switched_from": "", "story": "System-level ad-blocking in Android"}, {"id": 779255328, "item_id": 48703458, "url": "https://news.ycombinator.com/item?id=48703458", "by": "Bender", "date": "2026-06-27", "stance": "neutral", "quote": "I used to keep standby DoT Unbound servers around", "excerpt": "When all the authoritative servers support TLS I can enable TLS outbound but very few of them do at the moment. At some point someone is decrypting, turtles all the way down. I could of course just do DoT to another instance of Unbound somewhere else but I do not need to do that as my ISP does not care about my queries. I used to keep standby DoT Unbound servers around but I have never once seen a US ISP tinker with ", "context": "", "use_case": "DNS resolver", "switched_from": "", "story": "Choosing a Public DNS Resolver"}]}, {"label": "Flexible configuration", "summary": "Supports fallback to root servers, authority zones, and dnstap logging.", "quotes": [{"id": 803208544, "item_id": 50200534, "url": "https://news.ycombinator.com/item?id=50200534", "by": "drdexebtjl", "date": "2026-10-22", "stance": "neutral", "quote": "Yes, I use Unbound :)", "excerpt": "Yes, I use Unbound :) It\u2019s configured exactly like I mentioned: it tries a couple of resolvers, and if they all fail, tries authoritative servers starting from the root. That last part, missing from your suggested configuration, is the key: it\u2019s what ensures courts have to actually go after the parties responsible for the domain, and not just random DNS resolvers. > Beyond that I think you are asking for behavioral a", "context": "", "use_case": "recursive DNS resolver", "switched_from": "", "story": "Quad9 to exit France"}, {"id": 781680641, "item_id": 48855040, "url": "https://news.ycombinator.com/item?id=48855040", "by": "somat", "date": "2026-07-09", "stance": "neutral", "quote": "the man page sez an auth-zone directive could act like a self contained authoritive", "excerpt": "I use NSD myself, but the man page sez an auth-zone directive could act like a self contained authoritive zone served from a file. the other way it can be used to to speed up the cache for the actual authoritive data. https://man.openbsd.org/unbound.conf#AUTHORITY_ZONE_OPTIONS \"Authority zones are configured with auth-zone:, and each one must have a name. There can be multiple ones, by listing multiple auth-zone sect", "context": "", "use_case": "authoritative zones via auth-zone", "switched_from": "", "story": "OpenBSD has a use-after-free allowing local privilege escalation to root"}, {"id": 741143024, "item_id": 46321439, "url": "https://news.ycombinator.com/item?id=46321439", "by": "VTimofeenko", "date": "2025-12-18", "stance": "neutral", "quote": "Main data comes from unbound[1]", "excerpt": "Main data comes from unbound[1], I use vector[2] to ship and transform logs. Dnstap[3] log format IME works better than the standard logs, especially when it comes to more complex queries and replies. Undesired queries get 0.0.0.0 as a response which I track. Firewall is based on hand-rolled nftables rules. [1]: https://www.nlnetlabs.nl/projects/unbound/about/ [2]: https://vector.dev [3]: https://dnstap.info/Examples", "context": "", "use_case": "DNS resolver and query logging", "switched_from": "", "story": "Texas is suing all of the big TV makers for spying on what you watch"}]}, {"label": "Pairs with frontends", "summary": "Commonly used as the recursive resolver behind Pi-hole or AdGuard Home.", "quotes": [{"id": 744266771, "item_id": 46516673, "url": "https://news.ycombinator.com/item?id=46516673", "by": "elashri", "date": "2026-01-06", "stance": "neutral", "quote": "I use this DNS server connected to unbound to act as recursive DNS", "excerpt": "I hate ads with all my heart. And I go out of my way to religiously block them. I employ DNS blocking (through my own adguard home server) on my whole network (I use this DNS server connected to unbound to act as recursive DNS on all devices even when I am outside home). I use ublock origin on Firefox browser (one of the forks that guts Firefox ads and privacy settings by default) and on my iPhone I use wipr + uBlock", "context": "", "use_case": "recursive DNS", "switched_from": "", "story": "Vienam Bans Unskippable Ads, Requires Skip Button to Appear After 5 Seconds"}, {"id": 738469809, "item_id": 46154363, "url": "https://news.ycombinator.com/item?id=46154363", "by": "harry8", "date": "2025-12-04", "stance": "neutral", "quote": "This: https://docs.pi-hole.net/guides/dns/unbound/  was stupidly simple", "excerpt": "I don't know about unbound's blocklists and stats or indeed much about unbound at all. This: https://docs.pi-hole.net/guides/dns/unbound/ was stupidly simple, pi-hole has a gui that I was already used to and it all works great. So I think about and study other things that need fixing/improving in my life instead. To flip it, why would I use unbound without pi-hole? What's the win I haven't seen (or even looked at or ", "context": "", "use_case": "DNS resolver with Pi-hole", "switched_from": "", "story": "Kea DHCP: Modern, open source DHCPv4 and DHCPv6 server"}, {"id": 779329586, "item_id": 48708099, "url": "https://news.ycombinator.com/item?id=48708099", "by": "opengears", "date": "2026-06-28", "stance": "recommend", "quote": "take a look at adguard home, dnsmask or unbound. the best is to run your own infra", "excerpt": "take a look at adguard home, dnsmask or unbound. the best is to run your own infra", "context": "", "use_case": "DNS resolver", "switched_from": "", "story": "Choosing a Public DNS Resolver"}]}, {"label": "Runs on Pi", "summary": "One commenter keeps it always on with an old Raspberry Pi 3.", "quotes": [{"id": 779324048, "item_id": 48707753, "url": "https://news.ycombinator.com/item?id=48707753", "by": "TacticalCoder", "date": "2026-06-28", "stance": "recommend", "quote": "My old Pi 3 running unbound stays always on.", "excerpt": "> Random, but I don't understand why anyone would choose a \"block ads and trackers\" DNS server as a default. I use a \"block known malware and known porn sites\" and then, on top of that, I use gigantic blocklists blocking known ads and trackers. But then I've got a whitelist of allowed domains, which I updated on-the-go if that one site wife really needed wasn't working due to overzealous filtering. The reason is simp", "context": "Gen Xer running home DNS on a Pi 3", "use_case": "DNS blocking ads, trackers, malware", "switched_from": "", "story": "Choosing a Public DNS Resolver"}]}], "caveats": [{"label": "Upstream TLS", "summary": "Outbound TLS is limited because very few authoritative servers support it.", "quotes": [{"id": 779255328, "item_id": 48703458, "url": "https://news.ycombinator.com/item?id=48703458", "by": "Bender", "date": "2026-06-27", "stance": "neutral", "quote": "I used to keep standby DoT Unbound servers around", "excerpt": "When all the authoritative servers support TLS I can enable TLS outbound but very few of them do at the moment. At some point someone is decrypting, turtles all the way down. I could of course just do DoT to another instance of Unbound somewhere else but I do not need to do that as my ISP does not care about my queries. I used to keep standby DoT Unbound servers around but I have never once seen a US ISP tinker with ", "context": "", "use_case": "DNS resolver", "switched_from": "", "story": "Choosing a Public DNS Resolver"}]}, {"label": "No GUI", "summary": "One commenter prefers Pi-hole's GUI and questions the benefit of using Unbound without it.", "quotes": [{"id": 738469809, "item_id": 46154363, "url": "https://news.ycombinator.com/item?id=46154363", "by": "harry8", "date": "2025-12-04", "stance": "neutral", "quote": "This: https://docs.pi-hole.net/guides/dns/unbound/  was stupidly simple", "excerpt": "I don't know about unbound's blocklists and stats or indeed much about unbound at all. This: https://docs.pi-hole.net/guides/dns/unbound/ was stupidly simple, pi-hole has a gui that I was already used to and it all works great. So I think about and study other things that need fixing/improving in my life instead. To flip it, why would I use unbound without pi-hole? What's the win I haven't seen (or even looked at or ", "context": "", "use_case": "DNS resolver with Pi-hole", "switched_from": "", "story": "Kea DHCP: Modern, open source DHCPv4 and DHCPv6 server"}]}, {"label": "Setup refinement", "summary": "A self-hosted DoT setup with Unbound needed refining before it became low-maintenance.", "quotes": [{"id": 799951761, "item_id": 49996985, "url": "https://news.ycombinator.com/item?id=49996985", "by": "TheBozzCL", "date": "2026-10-07", "stance": "neutral", "quote": "Then nginx forwards the streams to Unbound, which filters out any local IPs from the responses to avoid leaks.", "excerpt": "I self-host my own DNS over TLS for domain-level adblocking. Maybe not the wisest decision, but it's working well so far and it doesn't require a lot of maintenance now that I've refined the setup. I use a DNS registrar and certificate that support wildcards. That way, I don't have to leak my DoT subdomain and I gain some obfuscation. Android's Private DNS option doesn't support alternate ports, so I'm forced to use ", "context": "self-hosts DNS over TLS", "use_case": "DNS resolver filtering local IPs", "switched_from": "", "story": "System-level ad-blocking in Android"}]}, {"label": "Build-dependent DoH", "summary": "The built-in DoH listener requires a build compiled with libnghttp2.", "quotes": [{"id": 779250176, "item_id": 48703136, "url": "https://news.ycombinator.com/item?id=48703136", "by": "Bender", "date": "2026-06-27", "stance": "recommend", "quote": "I use Unbound locally as a DoH server.", "excerpt": "I use Unbound locally as a DoH server. The Alpine Linux Unbound package is compiled with libnghttp2, required for the built in DoH listener. That's more than enough to enable ECH [1]. I pre-cache all the domains I use hourly via cron. My ISP is not going to dork with my DNS requests and their employees are bigger deviants than I. If I ever started browsing the web from a phone I would just set up my own public DoH se", "context": "", "use_case": "local DoH server", "switched_from": "", "story": "Choosing a Public DNS Resolver"}]}], "who": [{"by": "TheBozzCL", "context": "self-hosts DNS over TLS", "url": "https://news.ycombinator.com/item?id=49996985", "date": "2026-10-07"}, {"by": "TacticalCoder", "context": "runs it on a Pi 3 for years", "url": "https://news.ycombinator.com/item?id=49574964", "date": "2026-09-05"}, {"by": "stonecharioteer", "context": "homelabber", "url": "https://news.ycombinator.com/item?id=45876153", "date": "2025-11-10"}], "tags": ["self-hostable", "for home networks", "for DNS ad blocking", "for homelabbers", "for Raspberry Pi"], "use_cases": ["recursive dns resolver", "dns resolver", "dns resolver filtering local ips", "home network dns blocking", "self-hosted dns with blocking", "self-hosted recursive dns"], "compared": [{"slug": "pi-hole", "name": "Pi-hole", "co": 5, "switched_from": 0, "switched_to": 0}, {"slug": "dnsmasq", "name": "dnsmasq", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "adguard-home", "name": "AdGuard Home", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "proxmox", "name": "Proxmox", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "openwrt", "name": "OpenWrt", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=48702273", "title": "Choosing a Public DNS Resolver", "mentions": 5}, {"url": "https://news.ycombinator.com/item?id=50195959", "title": "Quad9 to exit France", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48347171", "title": "Encrypted Client Hello Doesn't Help With Privacy", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49983647", "title": "System-level ad-blocking in Android", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49776729", "title": "ChatGPT now knows what you do on other websites via ad collector", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49569663", "title": "An open DNS recursive service for free security and high privacy", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1}, "2025-12": {"neutral": 2, "recommend": 1}, "2026-01": {"neutral": 1}, "2026-02": {"recommend": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {"neutral": 1}, "2026-06": {"neutral": 1, "recommend": 2}, "2026-07": {"neutral": 1}, "2026-08": {}, "2026-09": {"recommend": 3}, "2026-10": {"neutral": 2, "recommend": 1}}, "quotes": [{"id": 803216848, "item_id": 50201053, "url": "https://news.ycombinator.com/item?id=50201053", "by": "koyote", "date": "2026-10-22", "stance": "recommend", "quote": "I use unbound and have a similar question. Shouldn't we just encourage everyone to run their own resolvers (it's turnkey for the most part!)?", "excerpt": "> Does the fact I have written this resolver make me liable should it not block the domains they listed which may contain copyright infringing content? I use unbound and have a similar question. Shouldn't we just encourage everyone to run their own resolvers (it's turnkey for the most part!)? Will Sony/beIn start going after the root servers and enforce a global block?", "context": "", "use_case": "recursive DNS resolver", "switched_from": "", "story": "Quad9 to exit France"}, {"id": 803208544, "item_id": 50200534, "url": "https://news.ycombinator.com/item?id=50200534", "by": "drdexebtjl", "date": "2026-10-22", "stance": "neutral", "quote": "Yes, I use Unbound :)", "excerpt": "Yes, I use Unbound :) It\u2019s configured exactly like I mentioned: it tries a couple of resolvers, and if they all fail, tries authoritative servers starting from the root. That last part, missing from your suggested configuration, is the key: it\u2019s what ensures courts have to actually go after the parties responsible for the domain, and not just random DNS resolvers. > Beyond that I think you are asking for behavioral a", "context": "", "use_case": "recursive DNS resolver", "switched_from": "", "story": "Quad9 to exit France"}, {"id": 799951761, "item_id": 49996985, "url": "https://news.ycombinator.com/item?id=49996985", "by": "TheBozzCL", "date": "2026-10-07", "stance": "neutral", "quote": "Then nginx forwards the streams to Unbound, which filters out any local IPs from the responses to avoid leaks.", "excerpt": "I self-host my own DNS over TLS for domain-level adblocking. Maybe not the wisest decision, but it's working well so far and it doesn't require a lot of maintenance now that I've refined the setup. I use a DNS registrar and certificate that support wildcards. That way, I don't have to leak my DoT subdomain and I gain some obfuscation. Android's Private DNS option doesn't support alternate ports, so I'm forced to use ", "context": "self-hosts DNS over TLS", "use_case": "DNS resolver filtering local IPs", "switched_from": "", "story": "System-level ad-blocking in Android"}, {"id": 796471169, "item_id": 49779448, "url": "https://news.ycombinator.com/item?id=49779448", "by": "anygivnthursday", "date": "2026-09-20", "stance": "recommend", "quote": "pihole or unbound also supports blocklists", "excerpt": "For a home network network pihole or unbound also supports blocklists (bundled with opnsense for example if you also want a firewall). For Android, I use Rethink with Hagezi blocklists, so they block also when I am on mobile data (it is vpn based).", "context": "", "use_case": "home network DNS blocking", "switched_from": "", "story": "ChatGPT now knows what you do on other websites via ad collector"}, {"id": 793199425, "item_id": 49574964, "url": "https://news.ycombinator.com/item?id=49574964", "by": "TacticalCoder", "date": "2026-09-05", "stance": "recommend", "quote": "Then I also run my own DNS (unbound)", "excerpt": "Instead of CloudFlare's 1.1.1.1 I like CloudFlare's 1.1.1.3: it filters known porn and known malware sites. By now I expect many sites to be filtered out: too much crap out there. Then I also run my own DNS (unbound) and after seeing a warning from one of my banks about a phishing site where one letter differed in the domain name from the real bank's site, I went ballistic: I did generate hundreds of thousands (maybe", "context": "runs it on a Pi 3 for years", "use_case": "self-hosted DNS with blocking", "switched_from": "", "story": "An open DNS recursive service for free security and high privacy"}, {"id": 793126992, "item_id": 49570437, "url": "https://news.ycombinator.com/item?id=49570437", "by": "drnick1", "date": "2026-09-04", "stance": "recommend", "quote": "I have been running my own recursive DNS with Unbound for years and never thought it was a \"highly specialized undertaking.\"", "excerpt": "> Running a privacy-focused public DNS service is a highly specialized undertaking This seems like an overstatement: I have been running my own recursive DNS with Unbound for years and never thought it was a \"highly specialized undertaking.\" It took perhaps a couple of hours to set up in the pre-AI age. I filter ads and trackers using an aggressive blacklist[0]. [0] https://github.com/hagezi/dns-blocklists", "context": "", "use_case": "self-hosted recursive DNS", "switched_from": "", "story": "Shutting down our public encrypted DNS"}, {"id": 781680641, "item_id": 48855040, "url": "https://news.ycombinator.com/item?id=48855040", "by": "somat", "date": "2026-07-09", "stance": "neutral", "quote": "the man page sez an auth-zone directive could act like a self contained authoritive", "excerpt": "I use NSD myself, but the man page sez an auth-zone directive could act like a self contained authoritive zone served from a file. the other way it can be used to to speed up the cache for the actual authoritive data. https://man.openbsd.org/unbound.conf#AUTHORITY_ZONE_OPTIONS \"Authority zones are configured with auth-zone:, and each one must have a name. There can be multiple ones, by listing multiple auth-zone sect", "context": "", "use_case": "authoritative zones via auth-zone", "switched_from": "", "story": "OpenBSD has a use-after-free allowing local privilege escalation to root"}, {"id": 779329586, "item_id": 48708099, "url": "https://news.ycombinator.com/item?id=48708099", "by": "opengears", "date": "2026-06-28", "stance": "recommend", "quote": "take a look at adguard home, dnsmask or unbound. the best is to run your own infra", "excerpt": "take a look at adguard home, dnsmask or unbound. the best is to run your own infra", "context": "", "use_case": "DNS resolver", "switched_from": "", "story": "Choosing a Public DNS Resolver"}, {"id": 779324048, "item_id": 48707753, "url": "https://news.ycombinator.com/item?id=48707753", "by": "TacticalCoder", "date": "2026-06-28", "stance": "recommend", "quote": "My old Pi 3 running unbound stays always on.", "excerpt": "> Random, but I don't understand why anyone would choose a \"block ads and trackers\" DNS server as a default. I use a \"block known malware and known porn sites\" and then, on top of that, I use gigantic blocklists blocking known ads and trackers. But then I've got a whitelist of allowed domains, which I updated on-the-go if that one site wife really needed wasn't working due to overzealous filtering. The reason is simp", "context": "Gen Xer running home DNS on a Pi 3", "use_case": "DNS blocking ads, trackers, malware", "switched_from": "", "story": "Choosing a Public DNS Resolver"}, {"id": 779322592, "item_id": 48707662, "url": "https://news.ycombinator.com/item?id=48707662", "by": "TacticalCoder", "date": "2026-06-28", "stance": "recommend", "quote": "I run unbound too here. I love it that it takes wildcards to blacklist domains.", "excerpt": "I run unbound too here. I love it that it takes wildcards to blacklist domains. I'm using big lists of domains to block and then I've got a whitelist that supercedes the blocked ones. And I've got a little tool that takes: ayt7.ads.acme.com afi6.ads.acme.com foi5.ads.acme.com and simplifies it to: ads.acme.com Then I've got a script which generates variations of domains name I use. Say if I use: mybank.com (legit) I ", "context": "runs it on an old Raspberry Pi 3", "use_case": "DNS blocklists and phishing domain blocking", "switched_from": "", "story": "Choosing a Public DNS Resolver"}, {"id": 779255328, "item_id": 48703458, "url": "https://news.ycombinator.com/item?id=48703458", "by": "Bender", "date": "2026-06-27", "stance": "neutral", "quote": "I used to keep standby DoT Unbound servers around", "excerpt": "When all the authoritative servers support TLS I can enable TLS outbound but very few of them do at the moment. At some point someone is decrypting, turtles all the way down. I could of course just do DoT to another instance of Unbound somewhere else but I do not need to do that as my ISP does not care about my queries. I used to keep standby DoT Unbound servers around but I have never once seen a US ISP tinker with ", "context": "", "use_case": "DNS resolver", "switched_from": "", "story": "Choosing a Public DNS Resolver"}, {"id": 779250176, "item_id": 48703136, "url": "https://news.ycombinator.com/item?id=48703136", "by": "Bender", "date": "2026-06-27", "stance": "recommend", "quote": "I use Unbound locally as a DoH server.", "excerpt": "I use Unbound locally as a DoH server. The Alpine Linux Unbound package is compiled with libnghttp2, required for the built in DoH listener. That's more than enough to enable ECH [1]. I pre-cache all the domains I use hourly via cron. My ISP is not going to dork with my DNS requests and their employees are bigger deviants than I. If I ever started browsing the web from a phone I would just set up my own public DoH se", "context": "", "use_case": "local DoH server", "switched_from": "", "story": "Choosing a Public DNS Resolver"}, {"id": 773823776, "item_id": 48363986, "url": "https://news.ycombinator.com/item?id=48363986", "by": "Bender", "date": "2026-06-01", "stance": "neutral", "quote": "I put Unbound directly on the web to play with for now, having some quirks with haproxy.", "excerpt": "I put Unbound directly on the web to play with for now, having some quirks with haproxy. It has an hourly cron job that pre-caches the Cloudflare Top 20000 or so .com .net .org .is domains and some domains I use. https://doh.nochan.net/dns-query", "context": "", "use_case": "public DoH DNS resolver", "switched_from": "", "story": "Encrypted Client Hello Doesn't Help With Privacy"}, {"id": 773569904, "item_id": 48348119, "url": "https://news.ycombinator.com/item?id=48348119", "by": "Bender", "date": "2026-05-31", "stance": "neutral", "quote": "In my unbound.conf it looks like this:", "excerpt": "In my unbound.conf it looks like this: # https://dohint.mydomain.tld/dns-query # lan interface interface: [x.x.x.x]@443 # wifi interface interface: [x.x.x.x]@443 https-port: 443 http-query-buffer-size: 16m http-response-buffer-size: 16m http-max-streams: 420 tls-service-key: \"/etc/unbound/keys.d/unbound_server.key\" tls-service-pem: \"/etc/unbound/keys.d/unbound_server.pem\" Then in browsers / devices I set a custom DoH", "context": "", "use_case": "DoH/DoT DNS resolver", "switched_from": "", "story": "Encrypted Client Hello Doesn't Help With Privacy"}, {"id": 751476016, "item_id": 46967251, "url": "https://news.ycombinator.com/item?id=46967251", "by": "TacticalCoder", "date": "2026-02-10", "stance": "recommend", "quote": "a good old Pi as an unbound DNS server that is on 24/7", "excerpt": "Like many here I also run a few things at home and I've got a variety of machine: a good old Pi as an unbound DNS server that is on 24/7, A N100 modern NUC, running headless, to stream movies/music (wife or kid or I turn it on when needed), a good old rock stable solid HP Z440 workstation which I use as a server (ECC RAM and 14 cores, yummy) for Proxmox/VMs/Docker/ZFS, etc. The workstation which I use as a server is ", "context": "runs a home lab", "use_case": "home DNS server", "switched_from": "", "story": "The Switch to Linux and the Beginning of My Self-Hosting Journey"}, {"id": 744266771, "item_id": 46516673, "url": "https://news.ycombinator.com/item?id=46516673", "by": "elashri", "date": "2026-01-06", "stance": "neutral", "quote": "I use this DNS server connected to unbound to act as recursive DNS", "excerpt": "I hate ads with all my heart. And I go out of my way to religiously block them. I employ DNS blocking (through my own adguard home server) on my whole network (I use this DNS server connected to unbound to act as recursive DNS on all devices even when I am outside home). I use ublock origin on Firefox browser (one of the forks that guts Firefox ads and privacy settings by default) and on my iPhone I use wipr + uBlock", "context": "", "use_case": "recursive DNS", "switched_from": "", "story": "Vienam Bans Unskippable Ads, Requires Skip Button to Appear After 5 Seconds"}, {"id": 741833440, "item_id": 46364590, "url": "https://news.ycombinator.com/item?id=46364590", "by": "TacticalCoder", "date": "2025-12-23", "stance": "recommend", "quote": "I run the unbound DNS (on a little Pi so it's on 24/7) with gigantic killfiles", "excerpt": "It's a bit tricky in that browsers may be using TCP_NODELAY anyway or use QUIC (UDP) and whatnots BUT, in doubt, I've got a wrapper script around my browsers launcher script that does LD_PRELOAD with TCP_NODELAY correctly configured. Dunno if it helps but it helps me feel better. What speeds up browsing the most though IMO is running your own DNS resolver, null routing a big part of the Internet, firewalling off enti", "context": "runs own DNS resolver on a Pi", "use_case": "local DNS resolver with blocklists", "switched_from": "", "story": "It's Always TCP_NODELAY"}, {"id": 741143024, "item_id": 46321439, "url": "https://news.ycombinator.com/item?id=46321439", "by": "VTimofeenko", "date": "2025-12-18", "stance": "neutral", "quote": "Main data comes from unbound[1]", "excerpt": "Main data comes from unbound[1], I use vector[2] to ship and transform logs. Dnstap[3] log format IME works better than the standard logs, especially when it comes to more complex queries and replies. Undesired queries get 0.0.0.0 as a response which I track. Firewall is based on hand-rolled nftables rules. [1]: https://www.nlnetlabs.nl/projects/unbound/about/ [2]: https://vector.dev [3]: https://dnstap.info/Examples", "context": "", "use_case": "DNS resolver and query logging", "switched_from": "", "story": "Texas is suing all of the big TV makers for spying on what you watch"}, {"id": 738469809, "item_id": 46154363, "url": "https://news.ycombinator.com/item?id=46154363", "by": "harry8", "date": "2025-12-04", "stance": "neutral", "quote": "This: https://docs.pi-hole.net/guides/dns/unbound/  was stupidly simple", "excerpt": "I don't know about unbound's blocklists and stats or indeed much about unbound at all. This: https://docs.pi-hole.net/guides/dns/unbound/ was stupidly simple, pi-hole has a gui that I was already used to and it all works great. So I think about and study other things that need fixing/improving in my life instead. To flip it, why would I use unbound without pi-hole? What's the win I haven't seen (or even looked at or ", "context": "", "use_case": "DNS resolver with Pi-hole", "switched_from": "", "story": "Kea DHCP: Modern, open source DHCPv4 and DHCPv6 server"}, {"id": 734018450, "item_id": 45876153, "url": "https://news.ycombinator.com/item?id=45876153", "by": "stonecharioteer", "date": "2025-11-10", "stance": "neutral", "quote": "I run openwrt, adguard, unbound, proxmox, jellyfin, samba, qbittorrent and syncthing", "excerpt": "Location: Bangalore, India Remote: Yes, any timezone will do. Willing to Relocate: No Technologies: Rust (5 years), Python (12 years), PostgreSQL (7 years), Distributed Systems (5 years), Linux (19 years and counting as my daily driver) and I can learn anything I put my mind to. Email: You'll find it on my about page, along with a meeting link. I build a lot of my own tools using Rust and Python, I'd love to talk abo", "context": "homelabber", "use_case": "homelab DNS resolver", "switched_from": "", "story": "Ask HN: Who wants to be hired? (November 2025)"}]}