Quick answer
How do I run a private DNS resolver with Unbound on a VPS?
To run a private DNS resolver with Unbound, install the unbound package, list the addresses it may listen on, allow only your own network with access-control, and test with dig. Gloamport’s Ember plan, 1 vCPU, 1 GB RAM, 20 GB NVMe, 1 TB traffic at $3.74 a month on 12 months, is enough for one person’s queries.
Which Unbound settings make a resolver private?
| Setting | Value in this guide | What the Unbound manual says |
|---|---|---|
| interface | 127.0.0.1 and your tunnel address | The addresses clients can query; with none given, Unbound listens on localhost |
| access-control | Your tunnel network allow | Most specific netblock wins; a client matching nothing is refused |
| hide-identity | yes | id.server and hostname.bind queries get REFUSED |
| hide-version | yes | version.server and version.bind queries get REFUSED |
| qname-minimisation | yes | Sends the minimum amount of information to upstream servers |
harden-dnssec-stripped | yes | A zone with a trust anchor but no DNSSEC data becomes bogus |
| prefetch | yes | Refreshes entries hit in the last 10% of their TTL, at about 10% more traffic |
| private-address | Your private ranges | Such answers are removed for public names, which guards against DNS rebinding |
Prices checked on
What does a private resolver change, and what does it not?
A private resolver changes who answers your DNS queries and who can see them from the network. Unbound resolves names itself, asking the root servers and then each zone’s servers, instead of forwarding to a public DNS provider. Your devices send queries only to your VPS, and the zones’ servers see the VPS address, not your own.
It does not hide your browsing. The sites you visit are still reached by their addresses, and the VPS provider carries your queries to the VPS. Plain DNS between your device and the VPS is not encrypted, which is why the safest place to listen is inside a tunnel such as WireGuard on the same VPS. Never leave port 53 open to the whole internet: an open resolver is something others will use, and the access-control lines below refuse them.
How to run Unbound as a private resolver
The commands are for Debian 13 and Ubuntu 24.04. The examples assume a WireGuard tunnel with the VPS at 10.8.0.1.
Install Unbound and a DNS test tool
Run apt install unbound bind9-dnsutils. The second package provides dig for testing. Both Debian 13 and Ubuntu 24.04 carry them.
Write the configuration
Create a file in /etc/unbound/unbound.conf.d/ with the server section from the first code block. Replace 10.8.0.1 and 10.8.0.0/24 with your tunnel address and network, or use only 127.0.0.1 if you query from the VPS itself.
Check the file
Run unbound-checkconf. The manual says it checks unbound.conf before use; it reports the file and line of any error.
Restart and look at the listeners
Restart the service, then run ss with -lunt and grep for :53. You should see only the addresses you listed, not 0.0.0.0.
Query it
From the VPS, run dig @127.0.0.1 example.org. From a device inside the tunnel, run dig @10.8.0.1 example.org. A refused answer from outside the allowed network is the correct result.
Point your devices at it
Set the DNS server of the tunnel configuration on your devices to the VPS tunnel address. Keep the firewall closed on port 53 to the public interface.
server:
interface: 127.0.0.1
interface: 10.8.0.1
access-control: 127.0.0.0/8 allow
access-control: 10.8.0.0/24 allow
hide-identity: yes
hide-version: yes
qname-minimisation: yes
harden-glue: yes
harden-dnssec-stripped: yes
prefetch: yes
private-address: 10.0.0.0/8
private-address: 172.16.0.0/12
private-address: 192.168.0.0/16sudo apt install unbound bind9-dnsutils
sudo unbound-checkconf
sudo systemctl restart unbound
sudo ss -lunt | grep :53
dig @127.0.0.1 example.org
dig @10.8.0.1 example.orgWhy must Unbound be restricted with access-control?
Because a resolver that answers anyone will be found and used by strangers. The Unbound manual says that with access-control the most specific netblock match is used, and a client that matches none is refused. List only the networks you own and everything else is refused by default.
Two defaults help. If no interface line is given, Unbound listens on localhost only, and do-not-query-localhost defaults to yes, so it will not send its own upstream queries to localhost addresses. Add private-address lines for your internal ranges so that a public name cannot point your devices at your own network.
Which Gloamport plan is enough for a DNS resolver?
The smallest plan carries a personal resolver, and sharing it with a VPN on the same server is the usual setup. Ember, 1 vCPU, 1 GB RAM, 20 GB NVMe, 1 TB traffic, is $3.74 a month on the 12-month term and $7.48 on a single month, and Gloamport lists it for A WireGuard VPN for a few devices. A resolver and WireGuard fit on it together. We have not benchmarked Unbound; if you serve many devices, Dusk at $5.25 a month on the 12-month term adds a second GB of memory (2 GB).
The cache is what you tune. The manual notes that cache-min-ttl, off by default, can cause trouble when set above about an hour, so leave it alone unless you know why you need it.
Is a self-run resolver better than a public DNS provider?
It depends on whom you prefer to trust with your query log, and a self-run resolver removes one party. A public DNS provider sees every name your devices look up; with Unbound on your own VPS, the only place those queries are collected is a server you control. The authoritative servers of the zones you ask about still see queries from the VPS address.
According to Gloamport’s survey of 10 November 2026, 28 of the 49 providers listed ask for no ID document at sign-up, so the VPS that runs it is available without handing documents over. For a view of the whole tunnel option, read Is a self-hosted VPN on a VPS better than a VPN service? and secure the host with How do I harden SSH on a new VPS?.
In summary
- Install unbound and bind9-dnsutils; configure in /etc/unbound/unbound.conf.d/.
- Use interface and access-control so only your own network can query it.
- A client that matches no access-control netblock is refused.
- hide-identity and hide-version make identity and version queries REFUSED.
- Run unbound-checkconf before every restart.
- Put it inside a WireGuard tunnel; plain DNS is not encrypted.
- Ember, $3.74 a month on 12 months, runs it.
Unbound private resolver: common questions
Does Unbound validate DNSSEC?
Unbound is a validating resolver, and its manual describes the trust-anchor and harden-dnssec-stripped options. Check your install with dig +dnssec and look for the ad flag in the answer.
Can I forward queries to another DNS provider instead?
Yes, Unbound supports forwarding, but then that provider sees your queries. This guide resolves recursively so no single provider does.
Why did unbound-checkconf fail?
It reports the file and line of the first error. Typical causes are a typo in a keyword or a missing colon. Fix it and run the command again before restarting the service.
Do I need to open port 53 in the firewall?
Only on the tunnel interface. Keep it closed on the public interface, and keep the access-control list limited to your own network.
What does prefetch do?
With prefetch set to yes, a cache hit in the last 10 percent of an entry’s lifetime triggers a background refresh. The manual says this adds about 10 percent more traffic and load.
Sources (1)
- unbound.conf(5) manual: server options — NLnet Labs (checked 2026-11-10)