How to Set Up Unbound DNS Resolver on Ubuntu

Unbound is a free, open-source, recursive, and validating DNS caching server. It uses DNS-over-TLS and DNS-over-HTTPS to encrypt connections between clients. Compared to Bind9, Unbound is lightweight and extremely fast. A caching server will help you reduce the loading time of the website by keeping the cache database on an Unbound server. It is also capable of DNSSEC validation and can serve as a trust anchor.

In this post, we will show you how to set up an Unbound DNS Resolver on Ubuntu 20.04.

In This Article

• Install Required Dependencies
• Install and Configure Unbound DNS
• Start Unbound DNS Service
• Test Unbound DNS
• Troubleshooting Unbound

Step 1 – Install Required Dependencies

Before starting, you must install some essential DNS tools in your system. You can install all of them using the following commands:

apt-get update -y

apt-get install bind9-utils dnsutils net-tools -y

Next, you will need to stop and disable the default systemd-resolved service in your server. You can do it with the following command:

systemctl stop systemd-resolved
systemctl disable systemd-resolved

Once all the packages are installed, you can proceed to the next step.

Step 2 – Install and Configure Unbound DNS

By default, the Unbound package is included in the Ubuntu default repository. You can install it using the following command:

apt-get install unbound -y

After installing Unbound DNS, you will need to configure it. By default, the Unbound main configuration file is located at /etc/unbound/unbound.conf. However, it is recommended to create a separate configuration file:

nano /etc/unbound/unbound.conf.d/myunbound.conf

Add the following lines:

server:
port: 53
verbosity: 0
num-threads: 2
outgoing-range: 512
num-queries-per-thread: 1024
msg-cache-size: 32m
interface: 0.0.0.0
rrset-cache-size: 64m
cache-max-ttl: 86400
infra-host-ttl: 60
infra-lame-ttl: 120
access-control: 127.0.0.0/8 allow
access-control: 0.0.0.0/0 allow
username: unbound
directory: "/etc/unbound"
logfile: "/var/log/unbound.log"
use-syslog: no
hide-version: yes
so-rcvbuf: 4m
so-sndbuf: 4m
do-ip4: yes
do-ip6: no
do-udp: yes
do-tcp: yes
remote-control:
control-enable: yes
control-port: 953
control-interface: 0.0.0.0

Save and close the file, then validate the configuration file with the following command:

unbound-checkconf /etc/unbound/unbound.conf.d/myunbound.conf

You should get the following output:

unbound-checkconf: no errors in /etc/unbound/unbound.conf.d/myunbound.conf

Next, create a log file for Unbound and set proper permissions:

touch /var/log/unbound.log
chown unbound:unbound /var/log/unbound.log

Step 3 – Start Unbound DNS Service

At this point, Unbound DNS is installed and configured. Now, restart the Unbound service and enable it to start at system reboot:

systemctl restart unbound
systemctl enable unbound

You can also verify the status of Unbound with the following command:

systemctl status unbound

Sample output:

● unbound.service - Unbound DNS server
     Loaded: loaded (/lib/systemd/system/unbound.service; enabled; vendor preset: enabled)
     Active: active (running) since Sun 2021-08-15 06:30:33 UTC; 7s ago
       Docs: man:unbound(8)
    Process: 2788 ExecStartPre=/usr/lib/unbound/package-helper chroot_setup (code=exited, status=0/SUCCESS)
    Process: 2791 ExecStartPre=/usr/lib/unbound/package-helper root_trust_anchor_update (code=exited, status=0/SUCCESS)
   Main PID: 2804 (unbound)
      Tasks: 2 (limit: 2353)
     Memory: 4.8M
     CGroup: /system.slice/unbound.service
             └─2804 /usr/sbin/unbound -d

Aug 15 06:30:32 ubuntu2004 systemd[1]: Starting Unbound DNS server...
Aug 15 06:30:33 ubuntu2004 package-helper[2796]: /var/lib/unbound/root.key has content
Aug 15 06:30:33 ubuntu2004 package-helper[2796]: success: the anchor is ok
Aug 15 06:30:33 ubuntu2004 systemd[1]: Started Unbound DNS server.

At this point, the Unbound service is started and listening on port 53. You can check it using the following command:

ss -antpl | grep 53

Sample output:

LISTEN    0         256                0.0.0.0:53               0.0.0.0:*        users:(("unbound",pid=3407,fd=6))                                              
LISTEN    0         256                0.0.0.0:53               0.0.0.0:*        users:(("unbound",pid=3407,fd=4))                                              
LISTEN    0         4096         127.0.0.53%lo:53               0.0.0.0:*        users:(("systemd-resolve",pid=356,fd=13))                                      
LISTEN    0         256                0.0.0.0:953              0.0.0.0:*        users:(("unbound",pid=3407,fd=7))                                              

Step 4 – Test Unbound DNS

Now, you must use the dig command and perform some DNS queries to test the Unbound DNS server.

We will use ubuntu.com for testing.

dig ubuntu.com @localhost

Sample output:

; <<>> DiG 9.16.1-Ubuntu <<>> ubuntu.com @localhost
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6037
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;ubuntu.com.			IN	A

;; ANSWER SECTION:
ubuntu.com.		60	IN	A	91.189.88.181
ubuntu.com.		60	IN	A	91.189.88.180

;; Query time: 307 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Aug 15 06:32:18 UTC 2021
;; MSG SIZE  rcvd: 71

As you can see, the query time is 307 msec in the first query. Your query is now cached.

Next, let’s rerun the same query:

dig ubuntu.com @localhost

Sample output:

; <<>> DiG 9.16.1-Ubuntu <<>> ubuntu.com @localhost
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 37832
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;ubuntu.com.			IN	A

;; ANSWER SECTION:
ubuntu.com.		49	IN	A	91.189.88.180
ubuntu.com.		49	IN	A	91.189.88.181

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Aug 15 06:33:36 UTC 2021
;; MSG SIZE  rcvd: 71

As you can see, the query time is 0 msec.

You can also test the Unbound DNS server from the client machine. In this case, you will need to specify your Unbound DNS server IP with the query:

dig ubuntu.com @69.87.221.220

Sample output:

; <<>> DiG 9.9.5-3ubuntu0.4-Ubuntu <<>> ubuntu.com @69.87.221.220
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 28051
;; flags: qr rd ad; QUERY: 0, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; Query time: 365 msec
;; SERVER: 69.87.221.220#53(69.87.221.220)
;; WHEN: Sun Aug 15 12:04:37 IST 2021
;; MSG SIZE  rcvd: 12

Step 5 – Troubleshooting Unbound

If you want to check the status of the Unbound DNS, run the following command:

unbound-control status

Sample output:

version: 1.9.4
verbosity: 0
threads: 2
modules: 3 [ subnet validator iterator ]
uptime: 65 seconds
options: reuseport control(ssl)
unbound (pid 3407) is running...

If you want to back up a DNS Cache to a text file, run the following command:

unbound-control dump_cache > cache.txt

You can verify the cache.txt file with the following command:

cat cache.txt

Sample output:

START_RRSET_CACHE
END_RRSET_CACHE
START_MSG_CACHE
END_MSG_CACHE
EOF

In some cases, your DNS server cannot reply to your query. In this case, you can flush the DNS cache using the following command:

unbound-control flush ubuntu.com

Conclusion

In the above guide, we explained how to install and use an Unbound DNS caching server on Ubuntu 20.04. We also tested using the dig command to query Unbound DNS and get a response. Try it out on your VPS from Atlantic.Net today!