Unbound

Unbound is a validating, recursive, caching DNS resolver designed to be fast, lean and standards-compliant. It implements modern privacy and DNSSEC-focused features and runs on Linux, BSD and macOS.

Key Features

• DNSSEC validation and support for DNSSEC-related optimizations (aggressive use of DNSSEC-validated cache).
• Recursive, validating and caching resolver behavior with configurable cache policies and performance tuning.
• Encrypted client transport: supports DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) to protect client→resolver traffic.
• Query Name Minimisation and other privacy-preserving standards to limit data sent to authoritative servers.
• Authority zones / ability to load a copy of the root zone for isolated or offline operation.
• libunbound API for embedding resolver functionality into applications.
• Configurable build options and runtime modules (TLS via OpenSSL, optional libevent, modular extensions).

Use Cases

• Run a local or network resolver for homes, offices or ISPs that needs DNSSEC and encrypted client transport.
• Deploy a privacy-focused resolver for client devices by enabling DoT/DoH and query name minimisation.
• Integrate DNS resolution into applications or services using the libunbound API for validated lookups.

Limitations and Considerations

• Unbound is a recursive/validating resolver and is not designed to act as an authoritative DNS server.
• Some features require build-time dependencies (C toolchain, OpenSSL, libexpat; building from source may need flex and bison). Optional modules (e.g., libevent) change runtime behavior and scalability trade-offs.
• Primary platform focus is Unix-like systems (Linux/BSD/macOS); Windows support is limited compared to Unix platforms.

Unbound is a mature, open-source DNS resolver maintained by NLnet Labs with an emphasis on security, privacy and standards compliance. It is widely packaged for major Unix-like distributions and is suitable for both personal and operator-scale resolver deployments.