DNS-over-TLS Setup with Unbound

Why Enable Encrypted DNS on Unbound?

By default, DNS queries are sent in plain text over UDP port 53. This means your ISP, network administrator, or anyone on your local network can see every domain you visit. Encrypted DNS solves this by wrapping your DNS queries in TLS or HTTPS encryption.

• DNS-over-HTTPS (DoH) sends DNS queries inside HTTPS on port 443 — the same port used for web traffic. This makes it very difficult to block or detect.
• DNS-over-TLS (DoT) sends DNS queries encrypted via TLS on port 853. It is a dedicated protocol that is easier for network admins to manage but may be blocked on some networks.

This guide shows you how to configure DoT on Unbound.

Step-by-Step Setup Instructions

Follow these steps to enable encrypted DNS on Unbound:

1. Install Unbound
   Install Unbound on your system. On Debian/Ubuntu: sudo apt install unbound. On RHEL/CentOS/AlmaLinux: sudo dnf install unbound. On Arch Linux: sudo pacman -S unbound.
2. Edit the Unbound configuration
   Open the Unbound configuration file: sudo nano /etc/unbound/unbound.conf. You will configure Unbound to forward queries to an upstream DNS resolver over TLS instead of resolving recursively.
3. Add forward zone with TLS
   Add the following to unbound.conf:\n\nserver:\n tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt\n\nforward-zone:\n name: "."\n forward-tls-upstream: yes\n forward-addr: 1.1.1.1@853#one.one.one.one\n forward-addr: 1.0.0.1@853#one.one.one.one\n forward-addr: 9.9.9.9@853#dns.quad9.net\n forward-addr: 149.112.112.112@853#dns.quad9.net\n\nThe @853 specifies the TLS port, and #hostname is used for certificate verification.
4. Set the TLS certificate bundle
   The tls-cert-bundle path varies by distribution. Debian/Ubuntu: /etc/ssl/certs/ca-certificates.crt. RHEL/CentOS: /etc/pki/tls/certs/ca-bundle.crt. Alpine: /etc/ssl/certs/ca-certificates.crt. This is required for Unbound to verify the upstream server TLS certificate.
5. Test and start Unbound
   Test the configuration: sudo unbound-checkconf. Fix any errors reported. Start Unbound: sudo systemctl enable --now unbound. Verify it is running: sudo systemctl status unbound.
6. Point your system DNS to Unbound
   Configure your system to use Unbound as its DNS resolver by setting the DNS server to 127.0.0.1 (localhost). On systemd systems, add DNS=127.0.0.1 to /etc/systemd/resolved.conf and restart systemd-resolved. Test with: dig @127.0.0.1 example.com.

After configuring encrypted DNS, it is recommended to clear your DNS cache and test the configuration using a DNS leak test site.

Recommended Encrypted DNS Providers

These providers support encrypted DNS and are compatible with Unbound:

Verify Your Encrypted DNS Setup

After configuring encrypted DNS on Unbound, run our DNS Privacy Check to verify your queries are encrypted and your ISP cannot see your DNS traffic.

Encrypted DNS Guides for Other Platforms

Set up encrypted DNS on all your devices for comprehensive protection:

• Windows 11 (DoH)
• macOS (DoH & DoT)
• Android (DoT)
• iPhone & iPad (DoH & DoT)
• Firefox (DoH)
• Chrome (DoH)
• Microsoft Edge (DoH)
• Linux (systemd-resolved) (DoT)
• Router (DoH & DoT)

Related Resources

• DoH vs DoT: Which encrypted DNS protocol should you use?
• DNS Privacy & Security Check tool
• Best private DNS servers
• All DNS guides
• Browse DNS servers by country

Frequently Asked Questions

Why use Unbound for encrypted DNS instead of systemd-resolved?

Unbound provides more granular control over DNS behavior including caching policies, DNSSEC validation, query minimization (RFC 7816), and per-zone forwarding rules. It is the preferred choice for servers, Pi-hole setups, and users who need advanced DNS features beyond what systemd-resolved offers.

Can Unbound use DNS-over-HTTPS instead of DNS-over-TLS?

Unbound natively supports DNS-over-TLS (DoT) for upstream forwarding. It does not natively support DNS-over-HTTPS (DoH) as a client. If you need DoH, chain Unbound with cloudflared or dnscrypt-proxy as the upstream forwarder.

Can I combine Unbound with Pi-hole?

Yes, this is a popular setup. Pi-hole handles ad blocking and forwards DNS queries to Unbound running locally. Configure Pi-hole to use 127.0.0.1#5335 (Unbound on a custom port) as its upstream DNS. Then configure Unbound with forward-tls-upstream for encrypted forwarding. See our Unbound setup guide for detailed instructions.

How do I verify Unbound is using DNS-over-TLS?

Run: sudo unbound-control stats_noreset | grep tls. Look for num.query.tls which shows the count of TLS queries. You can also capture traffic with: sudo tcpdump -i any port 853 -c 10 — you should see encrypted traffic to your configured upstream servers on port 853.