GICT knowledge base

How to Set Up a Local DNS Resolver

Published 1 January 2026

Setting up a local DNS resolver can dramatically improve your network’s speed, reliability, and privacy. By managing your DNS queries locally, you reduce latency, gain more control over name resolution, and can even filter unwanted domains or block ads. Whether you’re a power user, a developer, or a small business admin, running your own DNS resolver helps ensure fast, private, and reliable browsing for every device on your network.

This guide provides a step-by-step walkthrough for setting up a local DNS resolver on Linux using Unbound, one of the most popular and secure DNS resolver solutions. We’ll explain key concepts, compare alternatives, provide practical configurations, and discuss security and troubleshooting. By the end, you’ll understand not just how to get a resolver running, but also how to maintain and optimize it for your needs.

Why Set Up a Local DNS Resolver?

Speed: Local caching of DNS queries reduces lookup times and accelerates browsing, especially for frequently visited sites.
Privacy: Your DNS queries aren’t logged by third-party providers. You control where your data goes.
Reliability: Even if your ISP’s DNS servers are slow or offline, your network remains responsive thanks to local resolution and caching.
Security: Advanced DNS resolvers like Unbound support DNSSEC for authenticating DNS records, helping to prevent spoofing and man-in-the-middle attacks.
Flexibility: Filter domains (block ads, malicious sites), run internal DNS for your LAN, or set up custom records for development testing.

Key Concepts: Recursive, Forwarding, and Caching DNS

Recursive DNS Resolver: Looks up domain names from scratch, querying root servers, TLDs, and authoritative servers, then caches responses for future queries.
Forwarding DNS Resolver: Forwards queries to upstream DNS servers (e.g., Google, Cloudflare, OpenDNS), caching results locally.
Caching: Whether recursive or forwarding, caching reduces the number of queries sent to the internet and speeds up responses for repeat requests.

Unbound can be used as a recursive, forwarding, or pure caching resolver—this guide covers all three scenarios.

Prerequisites

A Linux-based system (server or desktop; examples here use Ubuntu/Debian, but Unbound is widely available)
Root or sudo privileges
Basic command-line skills
Local network access (if you want other devices to use your resolver)

Step 1: Install Unbound

Unbound is a secure, lightweight, and high-performance DNS resolver maintained by NLnet Labs. It’s suitable for desktops, servers, and even embedded devices.

Update your package list:
```
sudo apt update
```
Install Unbound:
```
sudo apt install unbound
```
Check version:
```
unbound -V
```

Step 2: Basic Configuration

The Unbound configuration file is usually at /etc/unbound/unbound.conf (or unbound.conf.d for includes). Back up the original file before editing:

sudo cp /etc/unbound/unbound.conf /etc/unbound/unbound.conf.bak

Sample Minimal Recursive Configuration

server:
    interface: 127.0.0.1
    access-control: 127.0.0.0/8 allow
    verbosity: 1
    hide-identity: yes
    hide-version: yes
    prefetch: yes
    prefetch-key: yes
    cache-min-ttl: 3600
    cache-max-ttl: 86400
    rrset-roundrobin: yes
    do-daemonize: no
    use-syslog: yes

    # Enable DNSSEC validation
    auto-trust-anchor-file: "/var/lib/unbound/root.key"

For LAN Access (Optional)

To allow your local network to use your resolver, add the following lines (adjust the subnet as needed):

interface: 0.0.0.0
access-control: 192.168.1.0/24 allow

Restart Unbound after making changes:

sudo systemctl restart unbound

Step 3: Test Your Resolver

Use dig or nslookup to verify your resolver is working:

dig @127.0.0.1 example.com

If you see a valid answer, Unbound is resolving queries locally. Repeat the query to see caching in action (second response should be much faster).

Step 4: Set Your System or LAN to Use the Resolver

On your local machine, set 127.0.0.1 as the primary DNS server in /etc/resolv.conf or via your network manager.
On a router, set your server’s LAN IP as the DNS server for DHCP clients.

Now all DNS requests from your devices will go through your fast, private local resolver.

Step 5: (Optional) Forward to Upstream DNS

To use Unbound as a forwarding resolver (using Google, Cloudflare, etc.), add to your unbound.conf:

forward-zone:
  name: "."
  forward-addr: 1.1.1.1
  forward-addr: 8.8.8.8

Restart Unbound to apply changes.

Step 6: Enable DNSSEC (Recommended)

DNSSEC (Domain Name System Security Extensions) validates DNS responses to prevent spoofing and attacks.

Unbound enables DNSSEC by default if auto-trust-anchor-file is set.
You can check validation by running:
```
dig @127.0.0.1 dnssec-failed.org
```
A SERVFAIL response means DNSSEC is working (as the domain intentionally fails validation).

Step 7: Logging, Monitoring, and Troubleshooting

Check logs for errors:

sudo journalctl -u unbound

sudo tail -f /var/log/syslog | grep unbound

Increase verbosity in unbound.conf for more detailed logs if needed.
Use unbound-control to check status:
```
sudo unbound-control status
```
Flush cache (if troubleshooting):
```
sudo unbound-control flush_zone .
```

Advanced: Blocking Ads, Malicious Domains, and Filtering

Unbound can be extended to block unwanted domains by loading a blocklist. Example:

# In unbound.conf, add:
local-zone: "examplead.com" refuse
local-zone: "malwaredomain.com" refuse

Scripted solutions exist to import large blocklists for ads and trackers.

For more advanced filtering, tools like Pi-hole offer web interfaces and statistics, but Unbound alone is highly effective for privacy and speed.

Security Best Practices

Restrict access to your resolver to trusted networks only (using access-control).
Keep Unbound and your OS up to date.
Enable DNSSEC for authenticity.
Run Unbound as a non-root user (default on most distributions).
Disable recursion for any IPs that should not use your server as a resolver.

Alternative DNS Resolver Solutions

Bind9: Powerful, but more complex and resource-heavy. Good for authoritative DNS or larger environments.
dnsmasq: Lightweight, often used for DHCP/DNS on routers and embedded devices. Simpler setup for small LANs.
Pi-hole: DNS-based ad-blocking with a web interface, can use Unbound as its upstream resolver for privacy.
Knot Resolver: Modern, fast, supports DNS-over-TLS and DNSSEC. Good for power users.

Unbound strikes a balance between security, performance, and simplicity for most home and small office setups.

Maintenance and Troubleshooting Tips

After updates or configuration changes, restart Unbound: sudo systemctl restart unbound
Monitor logs regularly for errors or unusual activity.
If DNS resolution fails, check firewall settings and ensure port 53 (UDP and TCP) is open.
Check that /etc/resolv.conf points to your local resolver IP.
Periodically check for Unbound updates and security advisories.

Conclusion

Setting up a local DNS resolver with Unbound gives you more speed, privacy, and control over your network’s DNS queries. With caching, DNSSEC, and the flexibility to filter domains or forward to trusted upstream servers, Unbound is an outstanding solution for both beginners and advanced users. By following these steps, you can enjoy a faster, more secure, and more reliable browsing experience on all your devices.

Related guides

Linux

Your bag