Unbound

Unbound is a validating, recursive, caching DNS resolver.

It is developed by NLnet Labs, a non-profit organization based in the Netherlands.

Its sister package is net-dns/nsd . Together, unbound (recursive, caching resolver) and nsd (authoritative name server) fulfil the same role as BIND.

Installation

USE flags

Emerge

Additional software

For testing DNS resolving, use the dig tool from the net-dns/bind package.

Configuration

Files

• /etc/unbound/unbound.conf - Global (system wide) configuration file.

Recursive resolver

Unbound can run as a recursive resolver, starting from the root hints file. This is unlike the 'usual' case where another DNS server performs this on your behalf.

First, fetch the hints file:

Then tell Unbound where to find it:

server:
 root-hints: "/etc/unbound/root.hints"

Note that tls-upstream is incompatible with this unless a fallback forward-zone is configured (which would defeat the point of a recursive resolver).

Running a recursive resolver is a de facto requirement for a mail server which performs DNSBL lookups, as providers need to estimate the volume of queries to prevent abuse.

Forwarder

One may wish to run a forwarder instead: in this setup, queries are dispatched to an external recursive resolver. This is faster but it means the relevant upstream resolvers that get contacted can see queries, and if they are unavailable, another resolver has to be used. Unbound supports multiple.

To forward all lookups to a selection of CloudFlare, Google, and Quad9:

forward-zone:
 name: "."
 forward-addr: 1.0.0.1@53#one.one.one.one
 forward-addr: 1.1.1.1@53#one.one.one.one
 forward-addr: 8.8.4.4@53#dns.google
 forward-addr: 8.8.8.8@53#dns.google
 forward-addr: 9.9.9.9@53#dns.quad9.net
 forward-addr: 149.112.112.112@53#dns.quad9.net

DNS over TLS

Unbound supports DNS over TLS. This protects the content of queries from those observing the network, though the remote resolver will still see the query contents.

server:
 tls-upstream: yes
forward-zone:
 name: "."
 forward-tls-upstream: yes
 forward-addr: 1.0.0.1@53#one.one.one.one
 forward-addr: 1.1.1.1@53#one.one.one.one
 forward-addr: 8.8.4.4@53#dns.google
 forward-addr: 8.8.8.8@53#dns.google
 forward-addr: 9.9.9.9@53#dns.quad9.net
 forward-addr: 149.112.112.112@53#dns.quad9.net

DNSSEC

To be able to use DNSSEC validation, a trust anchor file needs to be available on the system.

dnssec-root package

The unbound package is configured with a default anchor location (/etc/dnssec/root-anchors.txt) matching net-dns/dnssec-root . The package already depends on that, so it should work out-of-the-box.

It will be kept up-to-date via the package manager with no work required. This is the preferred method.

unbound-anchor

Another option is to use the unbound-anchor tool from net-dns/unbound to create the initial trust anchor.

The upstream Unbound documentation discusses some caveats with its use.

Once created, the anchor will need regular updates. Assuming the file is named /etc/unbound/var/dnssec-trust-anchors.key, one can instruct Unbound to perform these updates:

server:
 auto-trust-anchor-file: "/etc/unbound/var/dnssec-trust-anchors.key"

Alternatively, the unbound-anchor service can be used with systemd.

Manual fetch

The zone file can be downloaded from https://www.internic.net/domain/root.zone. The anchor can be extracted by searching for DNSKEY. Care is needed to validate this is indeed the correct public key.

Service

OpenRC

Removal

Unmerge

See Also

• BIND — a popular free software DNS server

• Daemons