A resolver that stays up

When DNS breaks, everything looks broken. A small local resolver is worth the effort, as long as it is treated like the critical service it is.

The layout

• Unbound resolves names recursively and listens on a local port.
• Pi-hole filters and caches, and uses Unbound as its only upstream.

That keeps queries out of third-party resolvers and gives you one place to see what your network is doing.

Unbound

server:
    interface: 127.0.0.1
    port: 5335
    do-ip6: no
    hide-identity: yes
    hide-version: yes
    prefetch: yes

Restart it and check that it answers:

sudo systemctl restart unbound
dig example.com @127.0.0.1 -p 5335

In Pi-hole, set the custom upstream to 127.0.0.1#5335 and untick everything else.

Habits that keep it alive

• Give the resolver a fixed address and hand it out through DHCP.
• Keep the configuration in version control.
• Test after every change with a query from a different machine.