Unbound
Unbound is an open-source, validating, recursive DNS resolver. It resolves DNS queries, verifies DNSSEC signatures and caches answers for subsequent requests.
From home routers and network appliances to enterprise networks and large-scale cloud infrastructure, Unbound gives operators control over a fundamental part of their network. It combines efficient DNS resolution with careful handling of the unreliable and sometimes hostile conditions of the public Internet.
Performance and resilience
A resolver needs to do more than answer quickly under favourable conditions. It must also cope with slow or unreachable servers, malformed responses and deliberately hostile traffic.
Unbound combines caching and parallel processing with checks on incoming answers and limits on the work involved in resolving a query. These mechanisms help protect both the integrity of DNS answers and the resources available to serve legitimate users.
Features such as prefetching popular records and serving expired data when fresh answers cannot be obtained give operators additional ways to maintain availability. Extensive configuration options allow performance and resource use to be adapted to the workload.
Straightforward to deploy, flexible to operate
Unbound provides sensible, safe defaults and a straightforward starting point for running a validating resolver. Operators can then adjust its behaviour to match their network, policies and operational requirements.
Its capabilities include:
- Resolution and forwarding: resolve names directly through the DNS hierarchy or forward selected queries to other resolvers and nameservers.
- Validation and privacy: verify DNSSEC signatures and reduce unnecessary disclosure of query information through QNAME minimisation.
- Local data and policy: provide local answers, control client access and apply filtering policies through Response Policy Zones.
- Encrypted DNS: offer encrypted services to clients and use supported encrypted transports to upstream resolvers.
- Operational control: monitor activity, inspect statistics and manage the resolver through its remote-control interface.
- Application integration: use the same validating resolution capabilities within applications through the libunbound library.
The documentation explains installation, configuration and the options available for specific deployments.
Developed for the Internet as it operates
Unbound’s development brings together work on Internet standards, experience from operators and ongoing security research. NLnet Labs engineers contribute to DNS standards and translate that work into an implementation that must interoperate with the wider Internet.
Maintenance extends beyond adding features. It includes investigating unexpected behaviour, improving performance under demanding workloads and addressing issues found through testing and external reports. We strive to be transparent: public development, release notes and security advisories make this work visible to users.
Open source, with professional support
Unbound is distributed under the BSD 3-Clause licence. All functionality is available in the open-source project, with no separate enterprise edition or gated features.
Organisations that depend on Unbound can obtain professional support and consultancy directly from NLnet Labs. Support agreements provide access to the engineers who develop the software, with service-level commitments and early security vulnerability notices under non-disclosure.
Professional support helps organisations operate critical infrastructure with confidence while contributing to the continued maintenance of the software they rely on.
Read the documentation · Explore Unbound in-depth. · Get professional support