Este conteúdo não está disponível no idioma selecionado.

Chapter 2. Setting up an unbound DNS server

download PDF

The unbound DNS server is a validating, recursive, and caching DNS resolver. Additionally, unbound focuses on security and has, for example, Domain Name System Security Extensions (DNSSEC) enabled by default.

2.1. Configuring Unbound as a caching DNS server

By default, the unbound DNS service resolves and caches successful and failed lookups. The service then answers requests to the same records from its cache.


  1. Install the unbound package:

    # dnf install unbound
  2. Edit the /etc/unbound/unbound.conf file, and make the following changes in the server clause:

    1. Add interface parameters to configure on which IP addresses the unbound service listens for queries, for example:

      interface: 2001:db8:1::1

      With these settings, unbound only listens on the specified IPv4 and IPv6 addresses.

      Limiting the interfaces to the required ones prevents clients from unauthorized networks, such as the internet, from sending queries to this DNS server.

    2. Add access-control parameters to configure from which subnets clients can query the DNS service, for example:

      access-control: allow
      access-control: allow
      access-control: 2001:db8:1::/64 allow
  3. Create private keys and certificates for remotely managing the unbound service:

    # systemctl restart unbound-keygen

    If you skip this step, verifying the configuration in the next step will report the missing files. However, the unbound service automatically creates the files if they are missing.

  4. Verify the configuration file:

    # unbound-checkconf
    unbound-checkconf: no errors in /etc/unbound/unbound.conf
  5. Update the firewalld rules to allow incoming DNS traffic:

    # firewall-cmd --permanent --add-service=dns
    # firewall-cmd --reload
  6. Enable and start the unbound service:

    # systemctl enable --now unbound


  1. Query the unbound DNS server listening on the localhost interface to resolve a domain:

    # dig @localhost
    ...    86400    IN    A
    ;; Query time: 330 msec

    After querying a record for the first time, unbound adds the entry to its cache.

  2. Repeat the previous query:

    # dig @localhost
    ...    85332    IN    A
    ;; Query time: 1 msec

    Because of the cached entry, further requests for the same record are significantly faster until the entry expires.

Next steps

  • Configure clients in your network to use this DNS server. For example, use the nmcli utility to set the IP of the DNS server in a NetworkManager connection profile:

    # nmcli connection modify Example_Connection ipv4.dns
    # nmcli connection modify Example_Connection ipv6.dns 2001:db8:1::1

Additional resources

  • unbound.conf(5) man page
Red Hat logoGithubRedditYoutubeTwitter


Experimente, compre e venda


Sobre a documentação da Red Hat

Ajudamos os usuários da Red Hat a inovar e atingir seus objetivos com nossos produtos e serviços com conteúdo em que podem confiar.

Tornando o open source mais inclusivo

A Red Hat está comprometida em substituir a linguagem problemática em nosso código, documentação e propriedades da web. Para mais detalhes veja oBlog da Red Hat.

Sobre a Red Hat

Fornecemos soluções robustas que facilitam o trabalho das empresas em plataformas e ambientes, desde o data center principal até a borda da rede.

© 2024 Red Hat, Inc.