Ramblings of an aging IT geek
← Ramblings of an aging IT geek
networking

stop trusting someone else's dns

Why I dropped the upstream forwarders at home and let Unbound resolve from the root servers itself.

Patch panel and network cables

For years my home network forwarded DNS to whatever public resolver was fashionable that month. It worked, mostly, until a resolver had a wobble and suddenly nothing in the house could find anything. The failure was always the same shape: the internet was up, ping by IP was fine, but every name lookup hung for five seconds and then gave up.

So I stopped forwarding and ran a proper recursive resolver. Unbound, on the same little box that already does DHCP. The config is almost embarrassingly short: no forward-zone, just let it talk to the root servers directly, turn on prefetch, set a sensible cache size, and enable DNSSEC validation. That last one is the bit people skip and then wonder why a domain "works everywhere except your network" when in fact you are the only one checking the signatures.

The honest downside is the first lookup of any new domain is a touch slower, because you are walking the delegation chain yourself instead of hitting a warm shared cache. In practice the cache fills within a day of normal browsing and you never notice. The upside is there is no longer a third party between me and the root, no third party logging every name my house resolves, and no single resolver outage that takes the whole place offline.

It has quietly outlasted three different public resolvers I would otherwise have been depending on. That is the whole pitch, really.