Pi-hole with Unbound a validating, recursive, caching DNS resolver as the upstream DNS.

WHY?
I do not trust upstream DNS providers like Google, Cloudflare, Quad9, DNS.Watch, OpenDNS, OpenNIC, Level3 etc.

HOW?
Follow the pi-hole documentation on unbound or just follow the instructions below.

I assume that you are using a Debian based distribution like Raspbian.
Install Unbound using apt:

 $ sudo apt install unbound

Fetch the updated root.hints (do this every six months):


$ wget -O root.hints https://www.internic.net/domain/named.root
$ sudo mv root.hints /var/lib/unbound/

Configure unbound:
Edit the file: /etc/unbound/unbound.conf.d/pi-hole.conf


$ sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf

    # If no logfile is specified, syslog is used
    # logfile: "/var/log/unbound/unbound.log"
    verbosity: 0

    # Change port if being used already
    port: 5353
    do-ip4: yes
    do-udp: yes
    do-tcp: yes

    # May be set to yes if you have IPv6 connectivity
    do-ip6: no

    # Use this only when you downloaded the list of primary root servers!
    root-hints: "/var/lib/unbound/root.hints"

    # Trust glue only if it is within the servers authority
    harden-glue: yes

    # Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
    harden-dnssec-stripped: yes

    # Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
    # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
    use-caps-for-id: no

    # Reduce EDNS reassembly buffer size.
    # Suggested by the unbound man page to reduce fragmentation reassembly problems
    edns-buffer-size: 1472

    # Perform prefetching of close to expired message cache entries
    # This only applies to domains that have been frequently queried
    prefetch: yes

    # One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
    num-threads: 1

    # Ensure kernel buffer is large enough to not lose messages in traffic spikes
    so-rcvbuf: 1m

    # Ensure privacy of local IP ranges
    private-address: 192.168.0.0/16
    private-address: 169.254.0.0/16
    private-address: 172.16.0.0/12
    private-address: 10.0.0.0/8
    private-address: fd00::/8
    private-address: fe80::/10

    interface: 127.0.0.1
    access-control: 127.0.0.0/8 allow
    access-control: ::1 refuse
    access-control: 2001:DB8::/32 refuse
    access-control: 0.0.0.0/0 refuse
    access-control: 192.168.1.0/24 refuse
    access-control: 192.168.2.0/24 refuse

    # Hardening configuration
    hide-identity: yes
    hide-version: yes
    harden-below-nxdomain: yes
    harden-referral-path: yes
    harden-algo-downgrade: no

Restart unbound: $ sudo systemctl restart unbound

Test query:


$ dig pi-hole.net @127.0.0.1 -p 5353


; <> DiG 9.11.5-P4-5.1-Raspbian <> pi-hole.net @127.0.0.1 -p 5353
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 24388
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;pi-hole.net.			IN	A

;; ANSWER SECTION:
pi-hole.net.		300	IN	A	206.189.252.21

;; Query time: 128 msec
;; SERVER: 127.0.0.1#5353(127.0.0.1)
;; WHEN: Mon Aug 05 21:32:13 PST 2019
;; MSG SIZE  rcvd: 56

$ dig sigfail.verteiltesysteme.net @127.0.0.1 -p 5353

; <> DiG 9.11.5-P4-5.1-Raspbian <> sigfail.verteiltesysteme.net @127.0.0.1 -p 5353
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 59563
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1472
;; QUESTION SECTION:
;sigfail.verteiltesysteme.net.	IN	A

;; Query time: 2025 msec
;; SERVER: 127.0.0.1#5353(127.0.0.1)
;; WHEN: Mon Aug 05 21:32:50 PST 2019
;; MSG SIZE  rcvd: 57

Log in to your Pi-hole dashboard, edit the DNS settings to Custom and input:

127.0.0.1#5353

This should make unbound the upstream DNS server for our Pi-hole.

Notes:
After installing unbound, it may fail to run because port 53 is being used by pihole-FTL or dnsmasq. Just ignore it and apply the configuration file for it to work after restarting the service.

Interesting read:
https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Clients#DNSPrivacyClients-Localforwarders
https://calomel.org/unbound_dns.html

References:
https://docs.pi-hole.net/guides/unbound/
https://explodie.org/writings/unbound-example-config.html
https://feeding.cloud.geek.nz/posts/setting-up-your-own-dnssec-aware/

© R1BNC, licensed under CC BY-SA 4.0