Deploy Unbound DNS on a VPS

What We Are Configuring and Why

We will be deploying Unbound – a high-performance, validating, recursive, and caching DNS server – on your own VPS. The primary task of Unbound is to resolve domain names (e.g., example.com to IP address 93.184.216.34) without relying on third-party DNS providers. Instead, Unbound directly queries the root DNS servers, and then the authoritative servers for each domain, building a chain of trust and performing DNSSEC validation.

What the reader will gain:

• Enhanced Privacy: Your DNS queries will not pass through the servers of Google, Cloudflare, your internet provider, or other companies that may collect data about your activity. Unbound communicates directly with root servers, eliminating intermediaries.
• Improved Security: Unbound supports DNSSEC (Domain Name System Security Extensions), which allows cryptographic verification of the authenticity of DNS responses. This protects against DNS spoofing and other attacks, ensuring that you always connect to the correct server.
• Increased Speed: After the initial query, Unbound caches responses. This means that repeated queries to the same domains will resolve significantly faster, as the information is already stored on your VPS. Additionally, direct communication with root servers can be faster than through congested public DNS servers.
• Full Control: You have complete control over the name resolution process, can configure blacklists (ad-blocking), whitelists, and other rules, adapting the DNS server to your needs.

What alternatives exist (cloud-managed vs self-hosted):

There are several approaches to DNS. You can use:

• Public DNS servers: For example, Google DNS (8.8.8.8), Cloudflare DNS (1.1.1.1), OpenDNS. They are easy to use, but you entrust your queries to a third party who may log them or use them for traffic analysis. This is the simplest, but least private option.
• Your internet provider's DNS servers: This is the standard default option. They are often slow, do not support DNSSEC, and, of course, your provider has full access to your DNS queries.
• Cloud-managed DNS services (for domain hosting): Such as AWS Route 53, Cloudflare DNS (for domain hosting), DigitalOcean DNS. These are services for managing DNS records of your own domains, not for resolving outgoing queries from your device.
• Self-hosted DNS servers (e.g., Unbound on a VPS): This is the approach we will use. It requires initial setup but provides maximum control, privacy, and security. You become your own DNS provider.

Why self-hosted on a VPS:

The choice of self-hosted Unbound on a VPS is driven by the desire for maximum privacy and security. A VPS provides you with a dedicated environment where you can configure Unbound exactly as you need it, without any restrictions or compromises from third-party providers. This is an ideal solution for those who value independence and want to build their infrastructure with high standards of security and confidentiality. A VPS ensures reliability, stability, and sufficient resources for Unbound to operate 24/7.

What VPS Configuration is Needed for This Task

Unbound is a fairly lightweight software, so it does not require powerful resources to operate. However, to ensure stable and fast performance, especially if you plan to use it for multiple devices or with high load, several points should be considered.

Minimum requirements:

• CPU: 1 core. Unbound is not a CPU-intensive application.
• RAM: 512 MB. This is sufficient for basic operation and caching. If you plan to cache a large number of records or use it for a large network, 1 GB might be considered.
• Disk: 10-20 GB NVMe/SSD. Unbound uses very little disk space, but this amount will be optimal for the operating system, logs, and other system files. NVMe or SSD will ensure fast system boot and file operations.
• Network: 100 Mbps or 1 Gbps. DNS queries are very light, so even 100 Mbps will be more than sufficient. More important are channel stability and low ping to root DNS servers.

Specific VPS plan for the task:

For most users deploying Unbound for personal use or a small team, a VPS with the following configuration will be ideal:

• 1 vCPU
• 1 GB RAM
• 20-40 GB NVMe/SSD disk
• 1 Gbps network port

Such a configuration will be sufficient for handling thousands of DNS queries per second, providing a large cache, and ensuring stable operation. You can consider a VPS with the specified characteristics to get a reliable platform for your Unbound server.

When a dedicated server is needed, not a VPS:

A dedicated server for Unbound is usually not required, unless you plan to:

• Serve tens of thousands of users with very high load.
• Use the same server for other very resource-intensive tasks that require guaranteed performance (e.g., large game servers, high-load databases).
• Require physical isolation and maximum security that virtualization cannot provide.

In most cases, even for corporate use, a powerful VPS will be more than sufficient.

Location: what it affects

The choice of VPS location for Unbound affects two key things:

1. Ping to you: The closer the VPS is to your physical location, the lower the latency when accessing your Unbound server. This directly affects the speed of DNS query resolution.
2. Ping to root DNS servers: Unbound will query root DNS servers worldwide. If your VPS is located in a region with good connectivity to the global internet infrastructure, this will ensure faster responses from root servers and, consequently, faster initial name resolution.

It is recommended to choose a location that is geographically close to the primary consumers of your DNS server (e.g., you or your team) and has good connectivity to major internet hubs.

Server Preparation

Before installing Unbound, you need to perform basic configuration of your VPS to ensure security and stability. We will use Ubuntu 24.04 LTS as one of the most popular and supported operating systems.

1. SSH Connection

First, connect to your new VPS via SSH. Use the credentials provided by your provider (IP address, root username, and password).

ssh root@ВАШ_IP_АДРЕС

After the first connection, you will likely need to change the root password.

2. System Update

Always start by updating the package list and the system itself to ensure you have the latest software versions and security patches installed.

sudo apt update # Update package list
sudo apt upgrade -y # Upgrade all installed packages to the latest versions
sudo apt autoremove -y # Remove unnecessary packages that were installed as dependencies and are no longer required

3. Creating a New User and Configuring sudo

Operating as the root user is insecure. Let's create a new user with limited privileges and add them to the sudo group.

adduser ВАШЕ_ИМЯ_ПОЛЬЗОВАТЕЛЯ # Create a new user. Follow the prompts to set the password and information.
usermod -aG sudo ВАШЕ_ИМЯ_ПОЛЬЗОВАТЕЛЯ # Add the user to the sudo group so they can execute commands with root privileges.

Now, exit the root session and log in as the new user:

exit
ssh ВАШЕ_ИМЯ_ПОЛЬЗОВАТЕЛЯ@ВАШ_IP_АДРЕС

To verify that sudo is working, try executing the command:

sudo apt update

If it prompts for your password, then everything is configured correctly.

4. SSH Key Configuration (Recommended)

To enhance security, disable password login and use only SSH keys. First, generate a key on your local machine if you don't have one yet:

ssh-keygen -t rsa -b 4096 # On your local machine

Then, copy the public key to your VPS:

ssh-copy-id ВАШЕ_ИМЯ_ПОЛЬЗОВАТЕЛЯ@ВАШ_IP_АДРЕС # On your local machine

After successful copying, edit the SSH configuration on the VPS to disable password authentication.

sudo nano /etc/ssh/sshd_config

Find and modify the following lines (or add them if they are missing):

# Disable root login
PermitRootLogin no

# Allow key-based authentication only
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no

Save changes (Ctrl+O, Enter) and exit (Ctrl+X). Restart the SSH service:

sudo systemctl restart sshd

Now you will be able to log in only with your SSH key.

5. Installing and Configuring the Firewall (UFW)

UFW (Uncomplicated Firewall) is an easy-to-use interface for iptables. It will allow you to restrict access to your server to only the necessary ports.

sudo apt install ufw -y # Install UFW
sudo ufw allow ssh # Allow SSH (port 22 by default)
sudo ufw allow 53/udp # Allow DNS traffic (port 53 UDP)
sudo ufw allow 53/tcp # Allow DNS traffic (port 53 TCP, for large responses and zone transfers)
sudo ufw enable # Enable the firewall. Confirm with 'y'.
sudo ufw status # Check firewall status

Make sure SSH is allowed before enabling UFW, otherwise you might lose access to the server.

6. Installing Fail2ban

Fail2ban protects the server from brute-force attacks by blocking IP addresses that have too many failed login attempts.

sudo apt install fail2ban -y # Install Fail2ban
sudo systemctl enable fail2ban # Enable automatic startup at system boot
sudo systemctl start fail2ban # Start the service
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local # Create a local configuration file
sudo nano /etc/fail2ban/jail.local # Edit the file

In the jail.local file, ensure that the [sshd] section is active (enabled = true) and, if desired, configure bantime (block time) and findtime (period for detecting failed attempts) as you see fit. You can configure a custom "jail" for Unbound, but this is a more advanced setting and not critical for a basic deployment.

# Example settings in jail.local
[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

Save changes and restart Fail2ban:

sudo systemctl restart fail2ban

Your server is now ready for Unbound installation.

Software Installation — Step-by-Step

In this step, we will install the Unbound DNS server itself. We will use the official Ubuntu repositories, as they provide stable and verified versions.

It is assumed that by 2026, Unbound version 1.19.x or newer will be available in the Ubuntu 24.04 LTS (Noble Numbat) repositories. We are targeting Unbound 1.19.0 as the current stable version.

1. Unbound Installation

Unbound is available in the standard Ubuntu repositories. We will install it using apt.

sudo apt update # Ensure the package list is up-to-date
sudo apt install unbound -y # Install the Unbound package

After installation, Unbound automatically starts as a service and is configured to listen on the local interface (127.0.0.1).

2. Checking Unbound Service Status

Let's ensure that Unbound is successfully installed and running.

sudo systemctl status unbound # Check Unbound service status

The output should show active (running). If not, check the logs with the command sudo journalctl -u unbound.

3. Downloading Current Root Hints

Unbound needs an up-to-date list of root DNS servers to perform recursive queries. This file is called root.hints or named.cache. It is usually installed with the package, but it's important to update it regularly.

sudo unbound-anchor -a /var/lib/unbound/root.key # Initialize and download the DNSSEC key for root servers

This command downloads and verifies the DNSSEC root key (DNSSEC Trust Anchor) and updates the root.hints file if necessary. This is critically important for DNSSEC validation.

4. Configuring Unbound to Operate as a Recursive Resolver

By default, Unbound is configured to listen only on the local interface. To allow it to respond to queries from other devices on your network or from the internet (if you choose to use it that way), you need to modify the configuration.

Open the main Unbound configuration file:

sudo nano /etc/unbound/unbound.conf

This file usually contains a server: section. We will add or modify parameters within this section. Find or add the following lines:

# Additional settings will be added to /etc/unbound/unbound.conf.d/
# We will create a new file for our settings to avoid modifying the main one

The best practice is to create a separate configuration file in the /etc/unbound/unbound.conf.d/ directory, which will be automatically included in the main unbound.conf configuration file. This simplifies management and updates.

sudo nano /etc/unbound/unbound.conf.d/custom-settings.conf # Create a new configuration file

Add the following content to /etc/unbound/unbound.conf.d/custom-settings.conf:

server:
    # Specify the IP address Unbound will listen on.
    # 0.0.0.0 means all available network interfaces.
    # If you have multiple IPs, you can specify a particular one: interface: ВАШ_IP_АДРЕС
    interface: 0.0.0.0@53

    # Allow queries only from specific networks.
    # Replace with your local network or IP addresses you trust.
    # For example, for the entire local network 192.168.1.0/24: access-control: 192.168.1.0/24 allow
    # If you want Unbound to be accessible from the internet (NOT RECOMMENDED WITHOUT ADDITIONAL PROTECTION):
    # access-control: 0.0.0.0/0 allow
    access-control: 127.0.0.1/32 allow # Allow localhost
    access-control: ::1/128 allow # Allow localhost IPv6

    # Set the size of the DNS record cache. 128MB is a good balance for a VPS.
    # Can be increased to 256MB or 512MB if sufficient RAM is available.
    rrset-cache-size: 128m
    msg-cache-size: 64m

    # Enable DNSSEC validation. Highly recommended for security.
    # Unbound will verify the authenticity of DNS responses.
    auto-trust-anchor-file: "/var/lib/unbound/root.key"

    # Enable logging. Useful for debugging.
    # log-queries: yes # Log all queries (can be very verbose)
    # log-replies: yes # Log all replies (can be very verbose)

    # Set minimum TTL for responses.
    # Helps avoid excessively short TTLs that could be set by attackers.
    cache-min-ttl: 3600 # 1 hour

    # Set maximum TTL for responses.
    # Prevents excessively long caching of outdated records.
    cache-max-ttl: 86400 # 24 hours

    # Force TCP for queries to root servers if UDP fails.
    # This can be useful for bypassing certain restrictions or UDP issues.
    harden-glue: yes
    harden-dnssec-stripped: yes
    harden-below-nxdomain: yes
    harden-referral-path: yes

    # Disable IPv6 if not used, to save resources and simplify.
    # do-ip6: no

    # Enable response with DNSSEC information for clients.
    do-daemonize: yes
    do-not-query-address: 127.0.0.1/8
    do-not-query-address: ::1/128
    hide-version: yes # Hide Unbound version
    # use-syslog: yes # Send logs to syslog
    # verbosity: 1 # Log verbosity level (0-5, 1 - default)

Save changes (Ctrl+O, Enter) and exit (Ctrl+X).

5. Checking Configuration and Restarting Unbound

Before restarting the service, always check the syntax of the configuration file to avoid errors.

sudo unbound-checkconf # Check syntax of Unbound configuration files

If the command shows no errors, the configuration is correct. Now restart the Unbound service to apply the changes.

sudo systemctl restart unbound # Restart Unbound service

Ensure Unbound is running again:

sudo systemctl status unbound

6. Testing Unbound

Now that Unbound is configured, let's test its operation. You can use dig or drill utilities for this. First, install dnsutils if they are not already installed.

sudo apt install dnsutils -y # Install dig utility

Execute a query to your Unbound server (which is now listening on 0.0.0.0 or your public IP):

dig @127.0.0.1 example.com # Query local Unbound
dig @ВАШ_IP_АДРЕС example.com # Query Unbound via external IP (if you allowed access)

In the response, you should see the IP address of example.com. It is important that the ANSWER SECTION contains records, and the FLAGS section has the ad (authentic data) flag, indicating successful DNSSEC validation.

If you want to verify that Unbound is indeed performing a recursive query, clear its cache and query a domain you haven't queried before:

sudo unbound-control reload # Clear Unbound cache
dig @127.0.0.1 newdomain.com # Replace with any domain you haven't queried

If everything works, Unbound is ready for use!

Configuration

After the basic Unbound installation, we can delve into its configuration for maximum privacy, security, and performance. We will continue to use the /etc/unbound/unbound.conf.d/custom-settings.conf file for our settings.

1. Enhancing Privacy and Security Settings

Add the following parameters to the server: section of your custom-settings.conf.

sudo nano /etc/unbound/unbound.conf.d/custom-settings.conf

Examples of additional parameters:

server:
    # ... (previous settings) ...

    # Privacy hardening
    # Hide Unbound version information (already added earlier)
    hide-version: yes

    # Hide server ID in CH TXT ID.SERVER responses
    hide-identity: yes

    # Hide server version in CH TXT VERSION.SERVER responses
    hide-trustanchor: yes

    # Disable responses to CH TXT hostname.bind, version.bind, etc. queries
    # This prevents disclosure of information about your server.
    # private-address: 192.168.0.0/16 # Example: all addresses in this network are considered private
    # private-address: 10.0.0.0/8
    # private-address: 172.16.0.0/12
    # private-address: fd00::/8 # IPv6 private addresses

    # Reject queries to private IP addresses if they are not explicitly allowed
    # This prevents attacks where an attacker tries to use your DNS for internal networks.
    do-not-query-address: 10.0.0.0/8
    do-not-query-address: 172.16.0.0/12
    do-not-query-address: 192.168.0.0/16
    do-not-query-address: 169.254.0.0/16
    do-not-query-address: ::1/128
    do-not-query-address: fc00::/7
    do-not-query-address: fe80::/10

    # Reject queries to local hosts (if you don't want Unbound to resolve them)
    # local-zone: "localhost." refuse
    # local-zone: "127.in-addr.arpa." refuse

    # Additional security settings for DNSSEC
    # Reject responses that do not comply with DNSSEC if the domain should be signed.
    harden-dnssec-stripped: yes

    # Reject responses that contain glue records for domains below the zone.
    harden-glue: yes

    # Reject responses that point to non-existent domains (NXDOMAIN) below the zone.
    harden-below-nxdomain: yes

    # Reject responses that point to the root server as a referrer.
    harden-referral-path: yes

    # Set the number of threads for query processing.
    # Usually equal to the number of CPU cores of your VPS.
    num-threads: 1 # For a VPS with 1 vCPU

    # Increase the number of file descriptors.
    # Important for high-load servers.
    outgoing-range: 8192 # Maximum number of outgoing queries
    num-queries-per-thread: 4096 # Maximum number of queries per thread

    # Enable aggressive NSEC caching.
    # Allows Unbound to cache information about non-existent domains, which speeds up responses for non-existent domains.
    aggressive-nsec: yes

    # DNS record prefetching.
    # Unbound will update records in the cache before their TTL expires, which improves performance.
    prefetch: yes
    prefetch-key: yes

    # Increase UDP response buffer.
    # Useful for DNSSEC, where responses can be large.
    edns-buffer-size: 1232 # Recommended value to prevent fragmentation

Save changes and check the configuration:

sudo unbound-checkconf
sudo systemctl restart unbound

2. Configuring Ad-blocking and Malicious Domain Blocking

You can use Unbound to block ads and malicious domains by using blocklists. This is done by adding a local-zone with type refuse or redirect.

Let's create a new file for blocklists:

sudo nano /etc/unbound/unbound.conf.d/adblock.conf

Add the following content. This is an example; you will need to regularly update this list or use a script for its automatic update.

server:
    # Block a known advertising domain
    local-zone: "doubleclick.net" refuse
    local-zone: "adservice.google.com" refuse
    local-zone: "tracking.example.com" refuse

    # Redirect to a local IP (e.g., 0.0.0.0 or 127.0.0.1)
    local-zone: "ads.example.com" redirect
    local-data: "ads.example.com A 0.0.0.0"

    # More extensive lists can be used.
    # Example:
    # include: "/etc/unbound/unbound.conf.d/blocklists/ads.conf"
    # include: "/etc/unbound/unbound.conf.d/blocklists/malware.conf"

For automation, you can create a script that will download lists from public sources (e.g., AdGuard DNS filter, OISD) and format them for Unbound. Example script (place it in /usr/local/bin/update-unbound-blocklist.sh):

#!/bin/bash

# Path to the Unbound blocklist file
BLOCKLIST_FILE="/etc/unbound/unbound.conf.d/adblock_generated.conf"
# URL of the blocklist source (e.g., OISD Basic)
# As of 2026, this URL may change, check for актуальность (relevance)
BLOCKLIST_URL="https://raw.githubusercontent.com/oisddev/oisd/main/abp/basic.txt"

echo "server:" > "$BLOCKLIST_FILE"
echo "    # Generated by update-unbound-blocklist.sh on $(date)" >> "$BLOCKLIST_FILE"
echo "    # Source: $BLOCKLIST_URL" >> "$BLOCKLIST_FILE"

# Download the list and convert it to Unbound format
# Skip comments and empty lines, add "refuse"
curl -s "$BLOCKLIST_URL" | grep -v '^!' | grep -v '^$' | while read -r domain; do
    # Remove '||' prefix and '^' suffix or other ABP-specific characters
    domain=$(echo "$domain" | sed -e 's/^||//' -e 's/\^$//' -e 's/\$//')
    # Filter empty lines after processing
    if [[ -n "$domain" ]]; then
        echo "    local-zone: \"$domain\" refuse" >> "$BLOCKLIST_FILE"
    fi
done

echo "Generated Unbound blocklist: $BLOCKLIST_FILE"

# Check Unbound configuration
sudo unbound-checkconf

# Restart Unbound to apply changes if the check is successful
if [ $? -eq 0 ]; then
    sudo systemctl restart unbound
    echo "Unbound restarted successfully."
else
    echo "Unbound configuration check failed. Not restarting."
fi

sudo chmod +x /usr/local/bin/update-unbound-blocklist.sh

sudo /usr/local/bin/update-unbound-blocklist.sh

server:
    # ...
    include: "/etc/unbound/unbound.conf.d/adblock_generated.conf"

dig @ВАШ_IP_АДРЕС dnssec-failed.org # A domain that should cause a DNSSEC error

dig @ВАШ_IP_АДРЕС doubleclick.net # Query to a blocked domain

dig @ВАШ_IP_АДРЕС example.com # First query
dig @ВАШ_IP_АДРЕС example.com # Second query

sudo nano /etc/resolv.conf # Editing the resolv.conf file (often overwritten)

nameserver ВАШ_IP_АДРЕС
nameserver 127.0.0.1 # If you are testing Unbound on the same VPS

# Example for Netplan (Ubuntu Server 24.04)
sudo nano /etc/netplan/00-installer-config.yaml

network:
  ethernets:
    enp0s3: # Your network interface name
      dhcp4: no
      addresses:
        - 192.168.1.10/24 # Your static IP
      routes:
        - to: default
          via: 192.168.1.1 # Your gateway IP
      nameservers:
        addresses: [ВАШ_IP_АДРЕС, 8.8.4.4] # Add your Unbound and a fallback DNS
  version: 2

sudo netplan try
sudo netplan apply