Unbound review: take control of your DNS lookups

Unbound is a free open-source DNS resolver for people who want to run their own internet address lookup service.¹ It suits a home network with someone willing to manage the setup. Its appeal is having more control over how those lookups happen, rather than handing that job to a default provider.

Last checked October 28, 2026.

At a glance

What it is: Software for operating your own DNS resolver.

Works on: Linux, BSD and macOS.¹ Windows installers are also available.²

Price: Free software; budget for the machine and electricity.¹

Licence: BSD three-clause licence.³

Best for: Households comfortable maintaining a small network service.

Official site: Unbound at NLnet Labs

What Unbound does and how it protects your privacy

DNS is the service that turns a website name into an address a computer can reach. Unbound can perform those lookups for one computer or a whole home network.⁶ Think of it as choosing who handles your internet address book.

In recursive mode, Unbound finds answers itself; in forwarding mode, it asks another resolver to do that work.⁴ For privacy, decide which arrangement you want before following a setup guide. Running software at home and choosing an outside DNS provider are different decisions.

Unbound supports DNSSEC, which checks whether signed DNS answers have been altered.⁶ That is an authenticity check. Ordinary recursive lookups still send information without encryption.⁶ Start with the Academy’s beginner’s guide to encrypted DNS if these choices feel unfamiliar.

Unbound’s key features

Reusable answers: A local cache keeps DNS answers available for later lookups.⁶ A cache is a temporary store.
Less detail per lookup: Query name minimisation reduces information sent upstream and is enabled by default.⁴ It asks for only the necessary parts of a name where possible.
Encrypted connections: DNS-over-TLS and DNS-over-HTTPS support lets clients encrypt their communication with Unbound.¹
Signed-answer checking: The setup guide includes a trust-anchor file to enable DNSSEC.⁸ This file starts the chain of trust used to check signatures.
Configuration checks: The supplied unbound-checkconf tool checks settings for errors before startup.⁸
Flexible installation: Install a packaged version or build the software from source.⁵ Most newcomers should choose the packaged route.

Unbound’s pros and cons

Pros

A worthwhile choice when control over household DNS is your main goal.
The local cache is a useful foundation for a shared home setup.
DNSSEC and encrypted DNS options let you build around specific needs.
The documentation gives you a starting point and room to learn.

Cons

Whole-network use needs a machine that stays on and remains reachable.⁶
The range of configuration options can feel overwhelming at first.⁸
A distribution’s package can lag behind or omit build-time options.⁵
Encryption and access rules deserve careful setup; set aside time to understand them.

Is Unbound safe and private?

NLnet Labs develops Unbound and publishes the project’s source code.¹ The current upstream release is 1.26.2, dated October 21, 2026, and includes security fixes.² Keep your installation updated through its chosen maintenance route.

The manual defaults query logging, reply logging and DNSTAP log export to off.⁴ These settings concern DNS records and operational reporting; they are not a blanket promise about every installation’s telemetry. Review the actual configuration, especially on a shared machine. Leave detailed logs off unless you need them to troubleshoot, and protect any logs you create.

Unbound can forward DNS over TLS, with certificate validation requiring the appropriate certificate settings.⁴ TLS is the encryption used to protect the connection. Choose this approach if an encrypted link to a selected resolver fits your needs, while remembering that you are still choosing an outside resolver to trust.

X41 D-Sec audited Unbound in 2019 with OSTIF sponsorship.⁷ An audit is a useful independent check, not a guarantee about later releases or your own configuration. Treat updates, restricted access and sensible logging as ongoing responsibilities.

How to get started with Unbound

Choose a small first project. Start with one computer. Write down its existing DNS settings so you can restore them before expanding the setup.
Use an official download route. The official installation guide recommends a package manager for first-time users.⁵ On Windows, use the installer linked from the official download page above.
Check the installed version. Run unbound -V to display its version and build options.⁵ Compare it with the upstream release information and your operating system’s update guidance.
Configure and validate. Follow the official configuration guide for DNSSEC and access settings, then run unbound-checkconf before restarting. Begin with local access, and allow only your household network when expanding.
Test before switching. The home-network guide uses dig example.com @127.0.0.1 to test a local resolver.⁶ Check that you get an answer before directing normal browsing to it.
Expand gradually. Test a second device before changing router-wide settings. Keep the previous configuration handy and agree on who will handle updates.

Who should use Unbound, and who might prefer something else?

Choose Unbound if operating your own resolver sounds useful and you can maintain it. It is especially appealing as a modest home-network project with a clear purpose: taking responsibility for DNS yourself. If you would rather browse without thinking about server upkeep, start with the encrypted-DNS guide instead.

For comparison, explore Technitium DNS Server or dnscrypt-proxy. Read their setup approaches before deciding which suits your confidence and available time.

Frequently asked questions

Is Unbound free?

Yes, the software is free.¹ Plan separately for the equipment, power and time needed to operate it. Choose it because you want to manage DNS, rather than expecting a hosted subscription service.

Does Unbound encrypt all DNS traffic?

No. Recursive operation alone does not make every lookup encrypted.⁶ Decide which connections need protection and follow the documentation for that arrangement; DNSSEC checks and connection encryption serve different purposes.

Does Unbound work on iPhone or Android?

Think of Unbound as a service on your network rather than a phone app.⁶ Set up and test the household resolver first, then consult your device’s network settings. Use NLnet Labs’ download links to identify the software discussed here.

Is Unbound still maintained?

Yes. The October 2026 release includes security fixes.² Make a plan to keep your installed copy maintained too; a recent upstream release does not automatically update a home server.