Running Unbound on a Raspberry Pi turns your device into a self-hosted, recursive DNS server. By doing this, your Pi resolves domains by querying root servers directly instead of forwarding requests to third parties like Google or Cloudflare, which drastically enhances your network’s privacy and security.
You can easily set up Unbound to work hand-in-hand with an existing ad-blocker like Pi-hole using the terminal.
Install the Unbound package:
sudo apt update sudo apt install unbound
Update your root servers file, which helps Unbound locate authoritative zone servers:
sudo wget https://internic.net -O /var/lib/unbound/root.hints
Create a dedicated configuration file for Pi-hole
sudo vi /etc/unbound/unbound.conf.d/pi-hole.conf
Paste the following configuration parameters into the file:
server: # If no logfile is specified, syslog is used logfile: "/var/log/unbound.log" verbosity: 0 interface: 127.0.0.1 port: 5335 do-ip4: yes do-udp: yes do-tcp: yes # Perform dot the query do-daemonize: yes # Hide server identity and version hide-identity: yes hide-version: yes # Ensure kernel buffer is large enough for queries msg-buffer-size: 65552 # Harden DNSSEC harden-glue: yes harden-dnssec-stripped: yes harden-below-nxdomain: yes # Use the root hints file root-hints: "/var/lib/unbound/root.hints" # Upstream cache cache-min-ttl: 3600 cache-max-ttl: 86400 # Prefetch useful items prefetch: yes
Restart and Test
sudo systemctl restart ubound
Test that Unbound is resolving domains correctly:
dig pi-hole.net @127.0.0.1 -p 5335
Connect to Pi-hole
Now, you need to point your ad-blocker to your newly created local Unbound instance: [1, 2]
- Log into your Pi-hole Admin Console.
- Navigate to Settings > DNS.
- Uncheck all other upstream DNS servers.
- Enter 127.0.0.1#5335 in the Custom 1 (IPv4) box.
- Click Save & Apply.