Unbound Configuration Reference
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The Unbound Configuration Reference describes the implementation of a hardened, validating, recursive, and caching DNS resolver designed specifically for Parrot OS. This system serves as the core component of the project's DNS security infrastructure, moving the system's DNS posture into the top 1-2% globally by implementing enterprise-grade security features.
The configuration focuses on three primary pillars: encryption via DNS over TLS (DoT), authenticity through DNSSEC validation, and strict privacy controls including query minimization and the elimination of local logging. It acts as a local resolver (listening on 127.0.0.1:53) that prevents ISP surveillance and protects against common network attacks.
Sources: README.md:3-12, configs/unbound.conf:1-6
Core Server Configuration
The server: block defines the fundamental operational parameters of the Unbound instance, including network bindings, protocol support, and access restrictions.
Network and Connectivity
Unbound is configured to bind exclusively to the loopback interface, ensuring that the resolver is only accessible to the local system. It supports both UDP and TCP protocols on port 53 while restricting traffic to IPv4 only.
The diagram above illustrates the network isolation strategy where Unbound only accepts queries from the local loopback address.
Sources: configs/unbound.conf:5-12, DNS_Hardening_Complete_Guide.md:166-173
Access Control
Security is maintained through strict access control lists (ACLs). Only the local subnet 127.0.0.0/8 is granted allow permissions, while all other traffic from 0.0.0.0/0 is explicitly refused.
| Parameter | Value | Description |
|---|---|---|
interface | 127.0.0.1 | Loopback interface binding |
port | 53 | Standard DNS port |
access-control | 127.0.0.0/8 allow | Permits local queries |
access-control | 0.0.0.0/0 refuse | Blocks all non-local traffic |
Sources: configs/unbound.conf:14-16, README.md:126-132
Security and Privacy Hardening
The configuration implements several layers of security to prevent DNS-based attacks and metadata leakage.
Privacy Controls
- Query Minimization: Uses
qname-minimisation: yesandqname-minimisation-strict: yesto send only the minimum necessary information to upstream servers. - Logging Suppression: To maximize privacy,
verbosityis set to 1, and logging for queries, replies, and servfails is disabled. - Identity Protection: Identity and version strings are hidden (
hide-identity: yes,hide-version: yes) to prevent fingerprinting.
Attack Prevention
The system is hardened against DNS poisoning, MITM, and rebinding attacks through specific directives:
- DNSSEC: Validation is enforced using the root trust anchor (
/var/lib/unbound/root.key). - DNS Rebinding: Private IP ranges (e.g.,
10.0.0.0/8,192.168.0.0/16) are filtered usingprivate-addressdirectives to prevent internal network exposure. - Hardening Flags: Includes
harden-glue,harden-dnssec-stripped, andharden-algo-downgradeto ensure cryptographic integrity.
Sources: configs/unbound.conf:18-32, configs/unbound.conf:60-80, DNS_Hardening_Complete_Guide.md:329-345
DNS over TLS (DoT) and Upstream Forwarding
Unbound is configured to use DNS over TLS for all upstream queries, encrypting DNS traffic between the local resolver and the authoritative/recursive providers.
Forwarding Logic
The forward-zone for the root (".") is configured with forward-tls-upstream: yes. It utilizes multiple diverse providers to ensure resilience against BGP hijacking and provider downtime.
The sequence diagram shows the flow from a local unencrypted query to an encrypted upstream request via Port 853.
Configured Upstream Providers
| Provider | IP Address | TLS Hostname |
|---|---|---|
| Cloudflare (Primary) | 1.1.1.1, 1.0.0.1 | cloudflare-dns.com |
| Quad9 (Secondary) | 9.9.9.9, 149.112.112.112 | dns.quad9.net |
Sources: configs/unbound.conf:87-104, UNBOUND_TLS_STATUS.md:6-14
Performance and Resource Management
The configuration tunes Unbound's memory and threading for a balance between performance and security.
Cache and Memory Settings
The resolver uses specific cache sizes to improve response times for frequently accessed domains while maintaining a strict TTL policy.
| Cache Type | Size | Purpose |
|---|---|---|
rrset-cache-size | 100m | Resource Record set cache |
msg-cache-size | 50m | DNS message cache |
key-cache-size | 100m | DNSSEC key cache |
neg-cache-size | 10m | Negative response cache |
Concurrency and Limits
- Threading: Configured with
num-threads: 2and corresponding slab counts (msg-cache-slabs: 2, etc.) to prevent lock contention. - Rate Limiting: A
ratelimitof 1000 is applied to prevent the resolver from being used in DNS amplification attacks.
Sources: configs/unbound.conf:39-58, configs/unbound.conf:82-85
Monitoring and Maintenance
Operational status of the Unbound configuration can be verified using local system tools and provided scripts.
Status Verification
Proper operation is confirmed by checking for active TLS connections on port 853 and the presence of the ad (authenticated data) flag in DNS responses.
# Check for active DoT connections
sudo ss -tnp | grep :853
# Verify DNSSEC validation
dig @127.0.0.1 google.com +dnssec | grep flags
Sources: UNBOUND_TLS_STATUS.md:6-24, scripts/dns_tls_monitor.sh:26-32
Conclusion
The Unbound configuration provided in this project transforms a standard DNS resolver into a security-hardened gateway. By combining local access restrictions, DNS over TLS encryption, and rigorous DNSSEC validation, it ensures that DNS queries remain private, authentic, and resilient against external interference. This setup is integrated with system-level hardening scripts that protect the configuration from being overridden by other networking services.
Sources: README.md:214-216, DNS_Hardening_Complete_Guide.md:417-419