From DD-WRT Wiki

Revision as of 09:34, 22 July 2018 by Mile-Lile (Talk | contribs)
Jump to: navigation, search


Unbound is a very secure validating, recursive, and caching DNS server primarily developed by NLnet Labs, VeriSign Inc, Nominet, and Kirei. The software is distributed free of charge under the BSD license. The binaries are written with a high security focus, tight C code and a mind set that it is always under attack or remote servers are always trying to pass it bad information.

Unbound's design is a set of modular components which incorporate features including enhanced security (DNSSEC) validation, Internet Protocol Version 6 (IPv6), and a client resolver library API as an integral part of the architecture.

As for the configuration, a simple resolving caching DNS server which can be used for a single machine or multi-machine LAN is only a few lines long. Note that Unbound is not a full fledged authoritative server, but you can put in A records for forward and reverse resolution of a small private LAN.

In the future it is expected that many, if not all, other open source distributions will move to Unbound. FreeBSD 10 has already made the change as BIND is no longer included in the default install. BIND, also known as named, is getting extremely code bloated, slow and over complicated. Complication leads to security exploits and over twenty(20) of the last seventy(70) critical bugs in FreeBSD have been due to BIND itself. The other problem is BIND is used for around 70% of the worlds DNS servers leading to a monoculture environment. When an attack or exploit comes out it is advantageous as the attacker to go after the most used software. Unbound in comparison is an incredibly fast and secure DNS name server which, due to its small size, can easily be code audited for security.


The only thing you have to do is to tick Recursive DNS Resolving on index.asp page (Setup>Basic Setup tab) of your dd-wrt. Make sure you have working time/date (ntp client) otherwise Unbound will not work after reboot (DNSSEC validateing needs correct local time). It is important that you use Server IP for router NTP Client not hostname (e.g. instead of 0.europe.pool.ntp.org).

A default configuration is stored under /tmp/unbound.conf

You can check whether your Unbound resolver validates DNSSEC signatures on this link

Whether your DNS is leaking you can check here