Unbound

nlnetlabs.nl/projects/unbound
Awesome Privacy➔ Networking➔ DNS Clients➔ Unbound
Unbound

Validating, recursive, caching DNS resolve with support for DNS-over-TLS. Designed to be fast, lean, and secure Unbound incorporates modern features based on open standards. It's fully open source, and recently audited. (For an in-depth tutorial, see this article by DNSWatch.)

Also Consider

Open Source

Unbound Source Code

Author

NLnetLabs

Description

Unbound is a validating, recursive, and caching DNS resolver.

#dns#dns-privacy#dnssec#recursor#resolver

Homepage

https://nlnetlabs.nl/unbound

Repository

  • LicenseBSD-3-Clause
  • Created13 Jun 17
  • Primary languageC
  • Size102,291 KB
  • Stars5,010
  • Forks466
  • Watchers5,010

Language Usage

Language Usage

Project Health

Top Contributors

Recent Commits

  • W.C.A. Wijngaards(22 Oct 26)

    - Fix readthedocs status badge in the readme.

  • W.C.A. Wijngaards(21 Oct 26)

    - Fix header comments for outnet_comm_point_for_http for etag.

  • W.C.A. Wijngaards(21 Oct 26)

    - Fix unit test to silence validator module warnings.

  • W.C.A. Wijngaards(21 Oct 26)

    - Fix dynlibmod test for inplace callback termination.

  • W.C.A. Wijngaards(21 Oct 26)

    - Unit test for CVE-2026-35501.

  • W.C.A. Wijngaards(21 Oct 26)

    - Unit test for CVE-2026-50106.

  • W.C.A. Wijngaards(21 Oct 26)

    - The code repository continues with 1.26.3 under development, that includes the changes from before the 1.26.2 commits.

  • W.C.A. Wijngaards(21 Oct 26)

    Merge branch 'branch-1.26.2'

  • W.C.A. Wijngaards(21 Oct 26)

    - Fix CVE-2026-35501, Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. Thanks to Qifan Zhang from Palo Alto Networks for the report.

  • W.C.A. Wijngaards(21 Oct 26)

    - Fix CVE-2026-109125, Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'. Thanks to TaoFei Guo (Peking University), and Yang Luo and JianJun Chen (Tsinghua University) for the report.

  • W.C.A. Wijngaards(21 Oct 26)

    - Fix CVE-2026-96405, Aggregate DNS name chained pointer decompression work leads to degradation of service. Thanks to Yuheng Zhang (Tsinghua University and Jingxian Technology Co., Ltd.), Jianjun Chen (Tsinghua University), Zihan Wang (Z.AI Co., Ltd.) and Kaiwen Shen (CloudItera) for the report.

  • W.C.A. Wijngaards(21 Oct 26)

    - Fix CVE-2026-50106, Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. Thanks to Qifan Zhang from Palo Alto Networks for the report.

  • W.C.A. Wijngaards(21 Oct 26)

    - Fix CVE-2026-97206, DoQ path-migration can lead to use-after-free on multi-threaded deployments. Thanks to Kunta Chu and Jianjun Chen from Tsinghua University for the report.

  • W.C.A. Wijngaards(21 Oct 26)

    Set version to 1.26.2

  • W.C.A. Wijngaards(20 Oct 26)

    - Fix testbound to free reference pending packet.

  • W.C.A. Wijngaards(20 Oct 26)

    - Fix to remove debug print from unit test.

  • W.C.A. Wijngaards(20 Oct 26)

    Merge branch 'master' of github.com:NLnetLabs/unbound

  • W.C.A. Wijngaards(20 Oct 26)

    - Fix testbound so that it does not reference an already deleted pending packet, but its packet contents, when removing from the pending list.

  • Yorgos Thessalonikefs(20 Oct 26)

    - Terminate inplace callback progression if one of them errors out; suggestion by Rio Fujita.

  • Willem Toorop(20 Oct 26)

    Changelog entry for #1539: - Merge #1539: Send along ETag with auth zone xfrs over http(s), so unbound will not fetch the whole zone every refresh time, but only when it has changed.

  • Willem Toorop(20 Oct 26)

    Merge pull request #1539 from NLnetLabs/hackathon/get-root-zone-with-etag Send along ETag with auth zone xfrs over http(s) - #1422

  • Willem Toorop(20 Oct 26)

    Apply batched suggestions from code review Review feedback from @wcawijngaards and @gthess Co-authored-by: Wouter Wijngaards <[email protected]> Co-authored-by: Yorgos Thessalonikefs <[email protected]>

  • Willem Toorop(20 Oct 26)

    Apply batched suggestions from code review Co-authored-by: Wouter Wijngaards <[email protected]>

  • Willem Toorop(20 Oct 26)

    Make test compile work

  • Willem Toorop(20 Oct 26)

    Merge branch 'master' into hackathon/get-root-zone-with-etag

  • Yorgos Thessalonikefs(20 Oct 26)

    Changelog entry for #1536: - Merge #1536: Better documentation and warning message for no configured trust anchors.

  • Yorgos Thessalonikefs(20 Oct 26)

    Merge branch 'validator-warn-no-trust'

  • Yorgos Thessalonikefs(20 Oct 26)

    - Better wording.

  • Yorgos Thessalonikefs(20 Oct 26)

    - Add CONTRIBUTING.md, similar to other NLnet Labs projects.

  • W.C.A. Wijngaards(20 Oct 26)

    - Merge #1534: unbound-checkconf reads config, but zonefiles are read with an option, '-a'. This speeds up the checkconf before server start in the presence of large zone files. And it is similar to how nsd-checkconf behaves.

Unbound Security

5.9/10

Repo Security Summary

Updated 24 Aug 26 Fuzz tested

  • Maintained10/10
  • Security-Policy10/10
  • Code-Review1/10
  • Dangerous-Workflow10/10
  • PackagingN/A
  • Token-Permissions0/10
  • CII-Best-Practices0/10
  • Binary-Artifacts10/10
  • License10/10
  • Fuzzing10/10
  • Branch-ProtectionN/A
  • Signed-ReleasesN/A
  • Pinned-Dependencies0/10
  • SAST0/10

Unbound Website

Website

NLnet Labs - Unbound - About

Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. To help increase online privacy, Unbound supports DNS-over-TLS and DNS-over-HTTPS which allows clients to encrypt their communication. In addition, it supports various modern standards that limit …

Redirects

Redirects to https://nlnetlabs.nl/projects/unbound/about/

Security Checks

All 65 security checks passed

Server Details

  • IP Address128.140.76.106
  • Hostnamestatic.106.76.140.128.clients.your-server.de
  • LocationNuremberg,Bayern,Germany,EU
  • ISPHetzner Online GmbH
  • ASNAS24940

Associated Countries

  • ATAT
  • USUS
  • NLNL
  • DEDE

Safety Score

Website marked as safe

100%

Trackers

No known trackers found

Blacklist Check

nlnetlabs.nl was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview
View full report atweb-check.xyz

Unbound Docker

Container Info

pihole-unbound

A Linux network-level advertisement and Internet tracker blocking application which acts as a DNS sinkhole. This version has Ubound software installed on it so you don't need to rely on external DNS providers. When the installation is complete, navigate to your.ip.goes.here:1010/admin. Follow the article <a href='https://medium.com/@niktrix/getting-rid-of-systemd-resolved-consuming-port-53-605f0234f32f'>here</a>

#Other#Tools

View on DockerHub

cbcrowe/pihole-unbound:latest

Run Command

docker run -d \
  -p 53:53/tcp \
  -p 53:53/udp \
  -p 1010:80/tcp \
  -p 4443:443/tcp \
  -e ServerIP=${ServerIP} \
  -e TZ=${TZ} \
  -e DNSSEC=${DNSSEC} \
  -e DNS1=${DNS1} \
  -e DNS2=${DNS2} \
  -v /portainer/Files/AppData/Config/PiHole-Unbound:/etc/pihole \
  -v /portainer/Files/AppData/Config/PiHole-Unbound/DNS:/etc/dnsmasq.d \
  --restart=unless-stopped \
  cbcrowe/pihole-unbound:latest

Compose File

version: 3.8
services:
  pi-hole-unbound:
    image: "cbcrowe/pihole-unbound:latest"
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "1010:80/tcp"
      - "4443:443/tcp"
    environment:
      ServerIP: 192.168.0.X
      TZ: Europe\London
      DNSSEC: 
      DNS1: 127.0.0.1#5335
      DNS2: 127.0.0.1#5335
    volumes:
      - "/portainer/Files/AppData/Config/PiHole-Unbound:/etc/pihole"
      - "/portainer/Files/AppData/Config/PiHole-Unbound/DNS:/etc/dnsmasq.d"
    restart: unless-stopped

Environment Variables

  • Var NameDefault
  • ServerIP192.168.0.X
  • TZEurope\London
  • DNSSECnull
  • DNS1127.0.0.1#5335
  • DNS2127.0.0.1#5335

Port List

  • 53:53/tcp
  • 53:53/udp
  • 1010:80/tcp
  • 4443:443/tcp

Volume Mounting

  • Container PathHost Bind
  • /etc/pihole/portainer/Files/AppData/Config/PiHole-Unbound
  • /etc/dnsmasq.d/portainer/Files/AppData/Config/PiHole-Unbound/DNS

Unbound Reviews

More DNS Clients

View More...

About the Data: Unbound

Edit Unbound Data

You can edit Unbound's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

Origin Data

Modify Data

Delete Unbound Submit Edit to Unbound Add alternative

API

You can access Unbound's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/unbound

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share Unbound

Help your friends compare DNS Clients, and pick privacy-respecting software and services.
Share Unbound and Awesome Privacy with your network!

← Previous

DNScrypt-proxy 2

View DNS Clients (5)
Next →

Nebulo