Unbound
Open-source validating, recursive, caching DNS resolver developed by NLnet Labs.
HN commenters run it as their own recursive resolver at home123, praising how easy it is to self-host and pairing it with blocklists or Pi-hole and AdGuard Home to filter ads and trackers.45678 Complaints are few: one commenter notes that encrypting upstream queries is limited because few authoritative servers support TLS9, and another asks what Unbound adds over using Pi-hole alone.10
Why people recommend it
Easy self-hosting · 3
Commenters describe running their own resolver as turnkey, taking minutes to a couple of hours to set up.
“I use unbound and have a similar question. Shouldn't we just encourage everyone to run their own resolvers (it's turnkey for the most part!)?”
“I have been running my own recursive DNS with Unbound for years and never thought it was a "highly specialized undertaking."”
Show 1 more
“I use Unbound locally as a DoH server.”
DNS blocking · 3
Used with blocklists to filter ads, trackers, and phishing domains across a network.
“pihole or unbound also supports blocklists”
“I have been running my own recursive DNS with Unbound for years and never thought it was a "highly specialized undertaking."”
Show 1 more
“Then I also run my own DNS (unbound)”
Encrypted DNS · 3
Serves DNS over HTTPS or DNS over TLS, including behind nginx with filtering of local IPs.
“I use Unbound locally as a DoH server.”
“Then nginx forwards the streams to Unbound, which filters out any local IPs from the responses to avoid leaks.”
Show 1 more
“I used to keep standby DoT Unbound servers around”
Flexible configuration · 3
Supports fallback to root servers, authority zones, and dnstap logging.
“the man page sez an auth-zone directive could act like a self contained authoritive”
Show 1 more
“Main data comes from unbound[1]”
Pairs with frontends · 3
Commonly used as the recursive resolver behind Pi-hole or AdGuard Home.
“I use this DNS server connected to unbound to act as recursive DNS”
“This: https://docs.pi-hole.net/guides/dns/unbound/ was stupidly simple”
Show 1 more
“take a look at adguard home, dnsmask or unbound. the best is to run your own infra”
Runs on Pi · 1
One commenter keeps it always on with an old Raspberry Pi 3.
“My old Pi 3 running unbound stays always on.”
Caveats and dissent
Upstream TLS · 1
Outbound TLS is limited because very few authoritative servers support it.
“I used to keep standby DoT Unbound servers around”
No GUI · 1
One commenter prefers Pi-hole's GUI and questions the benefit of using Unbound without it.
“This: https://docs.pi-hole.net/guides/dns/unbound/ was stupidly simple”
Setup refinement · 1
A self-hosted DoT setup with Unbound needed refining before it became low-maintenance.
“Then nginx forwards the streams to Unbound, which filters out any local IPs from the responses to avoid leaks.”
Build-dependent DoH · 1
The built-in DoH listener requires a build compiled with libnghttp2.
“I use Unbound locally as a DoH server.”
Often compared with
Who recommends it in their own words
Threads where it came up
- Choosing a Public DNS Resolver 5 mentions
- Quad9 to exit France 2 mentions
- Encrypted Client Hello Doesn't Help With Privacy 2 mentions
- System-level ad-blocking in Android 1 mention
- ChatGPT now knows what you do on other websites via ad collector 1 mention
- An open DNS recursive service for free security and high privacy 1 mention
Data: unbound.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 20
“I use unbound and have a similar question. Shouldn't we just encourage everyone to run their own resolvers (it's turnkey for the most part!)?”
“Yes, I use Unbound :)”
“Then nginx forwards the streams to Unbound, which filters out any local IPs from the responses to avoid leaks.”
“pihole or unbound also supports blocklists”
“Then I also run my own DNS (unbound)”
“I have been running my own recursive DNS with Unbound for years and never thought it was a "highly specialized undertaking."”
“the man page sez an auth-zone directive could act like a self contained authoritive”
“take a look at adguard home, dnsmask or unbound. the best is to run your own infra”
“My old Pi 3 running unbound stays always on.”
“I run unbound too here. I love it that it takes wildcards to blacklist domains.”
“I used to keep standby DoT Unbound servers around”
“I use Unbound locally as a DoH server.”
“I put Unbound directly on the web to play with for now, having some quirks with haproxy.”
“In my unbound.conf it looks like this:”
“a good old Pi as an unbound DNS server that is on 24/7”
“I use this DNS server connected to unbound to act as recursive DNS”
“I run the unbound DNS (on a little Pi so it's on 24/7) with gigantic killfiles”
“Main data comes from unbound[1]”
“This: https://docs.pi-hole.net/guides/dns/unbound/ was stupidly simple”
“I run openwrt, adguard, unbound, proxmox, jellyfin, samba, qbittorrent and syncthing”