If you've already set up Pi-hole, well done. You've taken the first big step towards a faster, cleaner and more private internet, and every device on your network benefits, from smart TVs to tablets.
But here's a question: who is answering your DNS queries? If Pi-hole forwards them to Cloudflare, Google or OpenDNS, that company still sees every website your household looks up. They may promise privacy, but you're still trusting them.
The next step is to run your own DNS resolver. In this guide I'll show you how to add Unbound to Pi-hole, so your network does its own lookups instead of handing them to one big provider.
I'll also cover something people often get wrong: why I don't block Google AdSense, and why responsible ad blocking is better for everyone.
What is Unbound?
Unbound is a recursive DNS resolver. Out of the box, Pi-hole is a forwarder: it passes your questions on to another DNS server and waits for the answer. Unbound does the whole lookup itself. It starts at the internet's root servers, then asks the servers for .com, then the servers for the website itself, until it has the answer.
Here's what that gives you:
- No single outside company sees your full browsing history
- DNSSEC checks, which catch DNS answers that have been tampered with
- A local cache, so sites you visit often resolve almost instantly
To be honest about the limits: Unbound doesn't encrypt your lookups. Your ISP could still see them if it went looking, and the very first lookup of a site is a bit slower because Unbound has to do all the legwork. For most homes it's still a nice step up in privacy.
A note about ethical ad blocking
Pi-hole lets you block any domain, including ad platforms like Google AdSense. Just because you can doesn't mean you should, especially if you run a website or make videos yourself.
- AdSense helps fund small blogs, tutorial sites and creators
- Blocking it takes money away from the people making the content you enjoy
- Over-blocking can break pages and make sites frustrating to use
Responsible ad blocking means going after malware, aggressive trackers and pop-ups, not the ordinary ads that keep the web free. I don't add AdSense domains to my blocklists, and I'd suggest you don't either.
What you'll need
- A working Pi-hole on a Raspberry Pi (or another Debian-based system). If you haven't got one yet, start with my Pi-hole guide
- Terminal access, over SSH or with a keyboard and screen
- About 20 to 30 minutes
STEP 1Update your system
sudo apt update && sudo apt full-upgrade -y
STEP 2Install Unbound
This installs Unbound plus dnsutils, which gives us the dig command for testing:
sudo apt install unbound dnsutils -y
On Raspberry Pi OS and Debian, this also installs the dns-root-data package, which contains the list of root servers and keeps it updated for you. You don't need to download a root hints file by hand.
STEP 3Create a config file for Pi-hole
Create a new config file:
sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf
Paste in the following. It's based on the official Pi-hole documentation:
server:
verbosity: 0
interface: 127.0.0.1
port: 5335
do-ip4: yes
do-udp: yes
do-tcp: yes
# Set to yes only if your connection has working IPv6
do-ip6: no
prefer-ip6: no
harden-glue: yes
harden-dnssec-stripped: yes
use-caps-for-id: no
edns-buffer-size: 1232
prefetch: yes
num-threads: 1
so-rcvbuf: 1m
# Keep private addresses private
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: 172.16.0.0/12
private-address: 10.0.0.0/8
private-address: fd00::/8
private-address: fe80::/10
Save with Ctrl + O, press Enter, then exit with Ctrl + X.
Unbound only listens on 127.0.0.1 (the Pi itself) on port 5335, so it doesn't clash with Pi-hole, which uses the normal DNS port 53.
cache-min-ttl: 3600 and use-caps-for-id: yes. I've removed both. The first makes Unbound keep answers for at least an hour even when a website says they'll change sooner, and the second can cause DNSSEC failures.STEP 4Restart Unbound
sudo systemctl restart unbound
On newer Debian-based systems there's one extra job. A helper service called unbound-resolvconf can point the Pi's own DNS settings at Unbound on the wrong port, which causes odd problems. Check whether it's running:
systemctl is-active unbound-resolvconf.service
If that says active, turn it off:
sudo systemctl disable --now unbound-resolvconf.service
sudo sed -Ei 's/^unbound_conf=/#unbound_conf=/' /etc/resolvconf.conf
sudo rm -f /etc/unbound/unbound.conf.d/resolvconf_resolvers.conf
sudo systemctl restart unbound
STEP 5Test Unbound on its own
dig pi-hole.net @127.0.0.1 -p 5335
The first time it may take a moment, because Unbound is working its way down from the root servers. Run it again and the "Query time" should drop to almost nothing, because the answer is now cached.
Next, check DNSSEC is working:
dig fail01.dnssec.works @127.0.0.1 -p 5335
dig dnssec.works @127.0.0.1 -p 5335
The first should come back with status: SERVFAIL and no IP address (that domain is deliberately broken). The second should show status: NOERROR with an IP address. If you get timeouts instead, check your config file for typos.
STEP 6Tell Pi-hole to use Unbound
- Open the Pi-hole admin page at
http://pi.hole/adminorhttp://your-pi-ip/admin. - Go to Settings > DNS.
- Untick every upstream DNS server (Google, Cloudflare and so on).
- In the Custom DNS servers box, enter
127.0.0.1#5335. - Click Save.
Pi-hole now sends every lookup to Unbound on the same Pi.
STEP 7Check it all works together
From the Pi, run:
dig pi-hole.net
Then browse a few websites on your phone or laptop and look at the Query Log in Pi-hole. Lookups should be coming in and getting answered, with the upstream server shown as 127.0.0.1#5335.
Final thoughts: responsible control
With Pi-hole and Unbound working together, your home network now has its own private, self-contained DNS system. You rely less on outside companies, you get DNSSEC checks, and lookups for sites you visit often are very quick.
Just remember: blocking the nasty stuff is great, but please leave AdSense and other ethical ad networks alone. Supporting creators helps keep the internet free for everyone.
If you have questions about your Pi-hole and Unbound setup, just ask.
