Hacker News new | ask | show | jobs
by noinsight 297 days ago
You can just use Unbound for DNS.
3 comments

Unbound unfortunately has some a pair of issues ([1][2]) that in some situations (adblocking, source address based dns selection) can make it a less than optimal match for some use-cases.

[1]: https://github.com/NLnetLabs/unbound/issues/132

[2]: https://github.com/NLnetLabs/unbound/issues/210

From https://github.com/NLnetLabs/unbound/issues/132

"Some users of our service (NextDNS), discovered this issue since edgekey.net has been added to some anti-tracker blocklists, resulting in the blocking of large sites like apple.com, airbnb.com, ebay.com when used with unbound."

As Pi-Hole is a modified dnsmasq, NextDNS may be a modified unbound

I use tinydns or nsd

You can use unbound

I do not use a cache

For HTTP I use a localhost-bound TLS forward proxy that has the DNS data in memory; I gather the DNS data in bulk from various sources using various methods; there are no remote DNS queries when I make HTTP requests

Unbound is overkill for how I use DNS on the local network

Unbound is a recursive-only resolver. NSD is an authoritative-only resolver.

Those are different use cases.

"Unbound is a recursive-only resolver"

https://raw.githubusercontent.com/NLnetLabs/unbound/master/d...

https://raw.githubusercontent.com/NLnetLabs/unbound/master/d...

Unbound can also answer queries from data in a text file read into memory at startup, like an authoritative nameserver would; no recursion

Psst! NSD isn't a "resolver" at all. Traditional DNS terminology is tricky to use (given that what is covered by "resolver" in the RFCs does not match how most people see the system as divided up) but something that does not do the resolving part at all is definitely not a resolver.

* https://jdebp.uk/FGA/dns-server-roles.html