Repolode
Submit
NLnetLabs

NLnetLabs/unbound

A validating, recursive, caching DNS resolver designed to be fast and lean, with DNSSEC validation built in.

View on GitHubWebsite
Stars
5,002
Forks
464
Open issues
400
Last commit
2 days ago

What is it?

Unbound is a DNS resolver that answers queries by recursively walking the DNS hierarchy from the root servers, caching results along the way. It validates DNSSEC signatures, so clients can trust that the answers they receive have not been tampered with. It is written in C and can be built from source with the standard configure, make and make install steps, which need a C toolchain, OpenSSL and libexpat.

The resolver is configured through the unbound.conf file, whose options are documented in the unbound.conf(5) man page. For outgoing queries it uses a built-in port handling mechanism by default, with an optional libevent backend for setups that need many outgoing ports at once. The project provides an example configuration file to start from.

Key features

  • 01Recursive resolution starting from the DNS root servers.
  • 02DNSSEC validation of responses.
  • 03Caching of query results to reduce repeated lookups.
  • 04Optional libevent support for handling many outgoing ports.
  • 05Configuration through unbound.conf with a documented man page.

Use cases

  • Running a local or network-wide recursive DNS resolver.
  • Adding DNSSEC validation to a DNS setup.
  • Operating a resolver that serves many clients and needs many outgoing ports.

Quick start

  1. 1

    Install the C toolchain, OpenSSL headers, and libexpat

  2. 2

    Compile and install Unbound from the source directory

    ./configure && make && make install
  3. 3

    Write a configuration file based on the example config

Things to know

  • Building from the repository source requires flex and bison in addition to the C toolchain and OpenSSL.

Topics

#dns#dnssec#resolver#recursive-dns#caching#networking#dns-privacy#recursor

FAQ

What is unbound?
A validating, recursive, caching DNS resolver designed to be fast and lean, with DNSSEC validation built in. Unbound is a DNS resolver that answers queries by recursively walking the DNS hierarchy from the root servers, caching results along the way. It validates DNSSEC signatures, so clients can trust that the answers they receive have not been tampered with. It is written in C and can be built from source with the standard configure, make and make install steps, which need a C toolchain, OpenSSL and libexpat.
Is unbound free to use? What license does it have?
unbound is open source under the BSD-3-Clause license. Check the license terms before using it in commercial products.
Is unbound still maintained?
Actively maintained. The last commit to unbound was on Oct 22, 2026.
What can I use unbound for?
Running a local or network-wide recursive DNS resolver. Adding DNSSEC validation to a DNS setup. Operating a resolver that serves many clients and needs many outgoing ports.
How do I install unbound?
Install the C toolchain, OpenSSL headers, and libexpat Compile and install Unbound from the source directory: ./configure && make && make install Write a configuration file based on the example config
Where can I get unbound?
The source code and installation instructions are on GitHub: https://github.com/NLnetLabs/unbound

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects