unbound

Unbound is a validating, recursive, and caching DNS resolver implemented in C by NLnet Labs. It is designed to be used as a standalone local resolver or as a component within larger DNS deployments. Unbound focuses on security, reliability, and performance. Its core feature is DNSSEC validation, allowing it to validate DNS responses against DNSSEC signatures using a configurable set of trust anchors, including the root zone. When validation fails, Unbound can return a secure failure or a non-validating answer depending on policy.

Unbound supports standard DNS features such as recursion, caching, and the use of forwarders. It can be configured to listen on specific interfaces, support IPv4 and IPv6, and restrict queries by access-control lists. Administrators manage it through the configuration file unbound.conf and a runtime control interface. Tools like unbound-control and unbound-checkconf aid in management and validation.

It runs on multiple platforms, including Linux, BSD, Windows, and macOS, and can be run in chroot jails or with restricted privileges for enhanced security.

Unbound is distributed under a BSD-style license and is maintained by NLnet Labs and the wider community.

It is widely deployed as a resolver in personal networks, enterprise networks, and hosting environments and is frequently used as a building block in larger DNS infrastructures.