Ramblings of an aging IT geek
← Ramblings of an aging IT geek
networking

running my own recursive resolver at home

Replacing the ISP's DNS with a local Unbound resolver that talks to the root servers directly, and why the homelab is quieter for it.

Network cables plugged into a switch

For years I just used whatever DNS my ISP handed out, then later pointed everything at a public resolver because it was faster and the ISP's one kept lying about NXDOMAIN. This week I stopped doing either and stood up Unbound on a small box in the rack, resolving recursively from the root down.

The config is barely a page. Unbound ships with the root hints and DNSSEC validation more or less ready to go, so the meaningful part is telling it which networks are allowed to query it and how big a cache to keep.

server:
    interface: 0.0.0.0
    access-control: 10.0.0.0/8 allow
    cache-min-ttl: 300
    prefetch: yes

The honest answer to "is it faster" is no, not for the first lookup of anything, because now I am walking the delegation chain myself instead of hitting someone's warm cache. But the cache fills quickly, the second lookup of anything I actually use is local and instant, and prefetch keeps the popular names warm before they expire. The latency I notice day to day went down, not up.

What I really wanted was not speed. It was to stop handing a third party a complete log of every domain this house looks up, and to stop trusting that their answers are honest. That part worked the moment I changed the resolver on the LAN. Small change, and the network feels like mine again.