Unbound

nlnetlabs.nl/projects/unbound Desktop [Linux, Mac, OpenWrt & Windows]

Awesome Privacy ➔ Networking ➔ DNS Clients ➔ Unbound

Validating, recursive, caching DNS resolve with support for DNS-over-TLS. Designed to be fast, lean, and secure Unbound incorporates modern features based on open standards. It's fully open source, and recently audited. (For an in-depth tutorial, see this article by DNSWatch.)

Homepage: nlnetlabs.nl/projects/unbound
GitHub: github.com/NLnetLabs/unbound
Privacy: tosdr.org/en/service/2519
Web info: web-check.xyz/results/nlnetlabs.nl

Open Source

Unbound Source Code

Author

NLnetLabs

Description

Unbound is a validating, recursive, and caching DNS resolver.

#dns#dns-privacy#dnssec#recursor#resolver

Homepage

https://nlnetlabs.nl/unbound

License

BSD-3-Clause

Created

13 Jun 17

Last Updated

25 Feb 26

Latest version

release-1.24.2

Primary Language

Size

101,413 KB

Stars

4,279

Forks

424

Watchers

4,279

Language Usage

Star History

Top Contributors

Recent Commits

W.C.A. Wijngaards (25 Feb 26)
- Fix validator to set unchecked when validation recursion requests are passed. The edns subnet module checks if validation is needed for a cache response, and set the validator to protect the cache with validation for non-subnet lookups.
Yorgos Thessalonikefs (23 Feb 26)
- Fixed some typos reported in #1395 by rezky_nightky.
Yorgos Thessalonikefs (23 Feb 26)
- Fix to disallow cache lookup/store in external cachedb when a forwarder/stub forbids it with the no-cache option.
W.C.A. Wijngaards (23 Feb 26)
- Fix to make the cachedb_val_expired.crpl succeed.
W.C.A. Wijngaards (23 Feb 26)
- Fix to have cachedb not return expired bogus data as non-bogus.
W.C.A. Wijngaards (17 Feb 26)
- For #1405: local-zone always_refuse also blocks queries of type DS.
W.C.A. Wijngaards (17 Feb 26)
- Fix to remove unused conditional from cookie timestamp at worker env.
W.C.A. Wijngaards (16 Feb 26)
- Fix that cachedb aggressive negative responses have the RA flag set.
Yorgos Thessalonikefs (16 Feb 26)
- Fix #1404: Priming the root key fails after loading ipfire.org RPZ zones. Fixed by including the ZONEMD RRtype in the list of types to ignore for RPZ zones. Analysis and patch provided by ummeegge.
W.C.A. Wijngaards (11 Feb 26)
- Fix #1403: Inconsistency between do-nat64 and do-not-query-address during retries.
W.C.A. Wijngaards (09 Feb 26)
- Update generated man pages.
W.C.A. Wijngaards (09 Feb 26)
Changelog note and documentation for #1401. - Merge #1401: Add a new build-time option for system TLS. The --enable-system-tls flag enables the tls-use-system-policy-versions setting by default.
Petr Menšík (09 Feb 26)
Add a new build-time option for system TLS (#1401) We want to use crypto-policy provided configuration always in our builds. Allow changing the default of tls-use-system-policy-versions at build time by a simple configure parameter.
Yorgos Thessalonikefs (06 Feb 26)
- Fix #1389: [FR] replacement with ECC-GOST12 according to RFC9558. Patch contributed by Igor V. Ruzanov, available in contrib/gost12.patch.
W.C.A. Wijngaards (04 Feb 26)
Fix attribution of fix.
W.C.A. Wijngaards (04 Feb 26)
- Fix local privilege escalation on Windows. Thanks to Hao Huang for the report. The OpenSSL init calls are set to not load the openssl.cnf file when compiled for Windows.
Yorgos Thessalonikefs (03 Feb 26)
- Eagerly remove .skip mark files in between mini_tdir.sh runs in case there has been a change on the environment.
W.C.A. Wijngaards (27 Jan 26)
- Add test for allow-notify with a host name.
W.C.A. Wijngaards (26 Jan 26)
- Fix to not skip allow-notify hostname lookups when there are only urls.
W.C.A. Wijngaards (26 Jan 26)
Merge branch 'master' of github.com:NLnetLabs/unbound
W.C.A. Wijngaards (26 Jan 26)
- Fix that allow-notify entries with hostnames are copied after IPv4 and IPv6 lookup.
Yorgos Thessalonikefs (23 Jan 26)
- Update generated man pages.
Yorgos Thessalonikefs (23 Jan 26)
Changelog entry for #1396: - Merge #1396: Log Linux thread ID. - On Linux systems log the system-wide unique thread ID instead of Unbound's internal thread counter. - Introduce the 'log-thread-id' configuration option to manage logging the system-wide Linux thread ID for easier debugging with system tools.
Yorgos Thessalonikefs (23 Jan 26)
Merge pull request #1396 from NLnetLabs/features/thread-id
Yorgos Thessalonikefs (23 Jan 26)
- Introduce the 'log-thread-id' configuration option to manage logging the system-wide Linux thread ID for easier debugging with system tools.
Yorgos Thessalonikefs (23 Jan 26)
- On Linux systems log the system-wide unique thread ID instead of Unbound's internal thread counter.
W.C.A. Wijngaards (22 Jan 26)
- Fix http test tool petal to not print errors when there is no error.
W.C.A. Wijngaards (22 Jan 26)
- Fix that fast reload copies the iter_scrub_ns, iter_scrub_cname and max_global_quota options.
W.C.A. Wijngaards (21 Jan 26)
- Merge #1388: QNX Porting support for unbound.
nnarayanamurthy (21 Jan 26)
QNX Porting support for unbound branch-1.24.1 (#1388) * qnx Porting support for version release-1.24.1 * updating __QNXNTO__ with __QNX__

Unbound Website

Website

NLnet Labs - Unbound - About

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS and DNS-over-HTTPS which allows clients to encrypt their communication. In addition, it supports various modern standards that limit …

Redirects

Redirects to https://nlnetlabs.nl/projects/unbound/about/

Security Checks

All 66 security checks passed

Server Details

IP Address 185.49.140.10
Hostname open.nlnetlabs.nl
Location Amsterdam, Noord-Holland, Netherlands (Kingdom of the), EU
ISP Stichting NLnet Labs
ASN AS8587

Associated Countries

Safety Score

Website marked as safe

100%

Blacklist Check

nlnetlabs.nl was found on 0 blacklists

ThreatLog
OpenPhish
PhishTank
Phishing.Database
PhishStats
URLhaus
RPiList Not Serious
AntiSocial Blacklist
PhishFeed
NABP Not Recommended Sites
Spam404
CRDF
Artists Against 419
CERT Polska
PetScams
Suspicious Hosting IP
Phishunt
CoinBlockerLists
MetaMask EthPhishing
EtherScamDB
EtherAddressLookup
ViriBack C2 Tracker
Bambenek Consulting
Badbitcoin
SecureReload Phishing List
Fake Website Buster
TweetFeed
CryptoScamDB
StopGunScams
ThreatFox
PhishFort

Website Preview

View full report at
web-check.xyz

Unbound Docker

Container Info

pihole-unbound

A Linux network-level advertisement and Internet tracker blocking application which acts as a DNS sinkhole. This version has Ubound software installed on it so you don't need to rely on external DNS providers. When the installation is complete, navigate to your.ip.goes.here:1010/admin. Follow the article <a href='https://medium.com/@niktrix/getting-rid-of-systemd-resolved-consuming-port-53-605f0234f32f'>here</a>

#Other#Tools

DockerHub Metrics

Pull Count None
Stars None
Date Created Invalid Date
Last Updated just now

View on DockerHub

Run Command

docker run -d \ 
  -p 53:53/tcp \
  -p 53:53/udp \
  -p 1010:80/tcp \
  -p 4443:443/tcp \
  -e ServerIP=${ServerIP} \
  -e TZ=${TZ} \
  -e DNSSEC=${DNSSEC} \
  -e DNS1=${DNS1} \
  -e DNS2=${DNS2} \
  -v /portainer/Files/AppData/Config/PiHole-Unbound:/etc/pihole \
  -v /portainer/Files/AppData/Config/PiHole-Unbound/DNS:/etc/dnsmasq.d \
  --restart=unless-stopped \
  cbcrowe/pihole-unbound:latest

Compose File

version: 3.8
services:
  pi-hole-unbound:
    image: cbcrowe/pihole-unbound:latest
    ports:
      - 53:53:tcp
      - 53:53:udp
      - 1010:80:tcp
      - 4443:443:tcp
    environment:
      ServerIP: 192.168.0.X
      TZ: Europe\London
      DNSSEC: 
      DNS1: 127.0.0.1#5335
      DNS2: 127.0.0.1#5335
    volumes:
      - /portainer/Files/AppData/Config/PiHole-Unbound:/etc/pihole
      - /portainer/Files/AppData/Config/PiHole-Unbound/DNS:/etc/dnsmasq.d
    restart: unless-stopped

Environment Variables

Var Name Default
ServerIP 192.168.0.X
TZ Europe\London
DNSSEC null
DNS1 127.0.0.1#5335
DNS2 127.0.0.1#5335

Port List

53:53/tcp
53:53/udp
1010:80/tcp
4443:443/tcp

Volume Mounting

/portainer/Files/AppData/Config/PiHole-Unbound /etc/pihole
/portainer/Files/AppData/Config/PiHole-Unbound/DNS /etc/dnsmasq.d

Unbound Reviews

More DNS Clients

DNScrypt-proxy 2

(Desktop [BSD, Linux, Solaris, Windows, MacOS & Android])
dnscrypt.info

A flexible DNS proxy, with support for modern encrypted DNS protocols including DNSCrypt V2, DNS-over-HTTPS and Anonymized DNSCrypt. Also allows for advanced monitoring, filtering, caching and client IP protection through Tor, SOCKS proxies or Anonymized DNS relays.

Open Source DNSCrypt/dnscrypt-proxy

View DNScrypt-proxy 2 Report
Nebulo

(Android)
nebulo.app

Non-root, small-sized DNS changer utilizing DNS-over-HTTPS and DNS-over-TLS. (Note, since this uses Android's VPN API, it is not possible to run a VPN while using Nebulo.)

Open Source Ch4t4r/Nebulo

View Nebulo Report
RethinkDNS & Firewall

(Android)
rethinkdns.com/app

Free and open source DNS changer with support for DNS-over-HTTPS, DNS-over-Tor, and DNSCrypt v3 with Anonymized Relays. (Note, since this uses Android's VPN API, it is not possible to run a VPN while using RethinkDNS + Firewall.)

Open Source celzero/rethink-app

View RethinkDNS & Firewall Report
DNS Cloak

(iOS)
apps.apple.com/us/app/dnscloak-secure-dns-client/id1452162351

Simple all that allows for the use for dnscrypt-proxy 2 on an iPhone.

Open Source s-s/dnscloak

View DNS Cloak Report
Stubby

(Desktop [Linux, Mac, OpenWrt & Windows])
dnsprivacy.org/wiki/display/DP/DNS+Privacy+Daemon+-+Stubby

Acts as a local DNS Privacy stub resolver (using DNS-over-TLS). Stubby encrypts DNS queries sent from a client machine (desktop or laptop) to a DNS Privacy resolver increasing end user privacy. Stubby can be used in combination with Unbound - Unbound provides a local cache and Stubby manages the upstream TLS connections (since Unbound cannot yet re-use TCP/TLS connections), see example configuration.

Open Source getdnsapi/stubby

View Stubby Report

About the Data: Unbound

API

You can access Unbound's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/networking/dns-clients/unbound

The REST API is free, no-auth and CORS-enabled. To learn more, view the Swagger Docs or read the API Usage Guide.

About the Data

Beyond the user-submitted YAML you see above, we also augment each listing with additional data dynamically fetched from several sources. To learn more about where the rest of data included in this page comes from, and how it is computed, see the About the Data section of our About page.

Share Unbound

Help your friends compare DNS Clients, and pick privacy-respecting software and services.
Share Unbound and Awesome Privacy with your network!

← Previous

DNScrypt-proxy 2

View DNS Clients (6)

Nebulo

Awesome Privacy