[SOLVED] Which DNS-Servers does unbound use?



  • Hi!

    Might be a pretty simple question, but: which DNS-Servers does unbound actually use?
    I use it as a DNS-Resolver, so my DNS-Servers are:

    • 127.0.0.1
    • 8.8.8.8
    • 8.8.4.4

    (I configured the last two during installation).
    So are those google-DNS-Servers the ones, unbound uses?
    I couldn't find any specific servers in unbound.conf


  • Rebel Alliance

    Unbound will query root servers directly (unless you enable "Forwarding Mode")

    https://doc.pfsense.org/index.php/Unbound_DNS_Resolver


  • LAYER 8 Global Moderator

    You need to understand the dif between a forwarder and a resolver.  If your going to use pfsense out of the box config then it will be in resolver mode and ask roots hey who is authoritative for .com, hey .com ns who is authoritative for domain.com, hey domain.com ns what is A record for www.domain.com

    this seems to be a big issue with users understanding the difference.  If your going to use unbound in default resolver mode then really the only dns you should have listed in pfsense is loopback 127.0.0.1

    you then know for sure your getting the info straight from the horses mouth, and will have full dnssec support, etc..



  • Ah ok, so forwarding would mean, that pfSense "forwards" the Requests (to a public DNS or a DNS of my provider, I specified under "DNS-Servers"), but as a resolver it directly asks the root-DNS-servers?


  • LAYER 8 Global Moderator

    exactly but roots only know the name servers for the tld, the tld servers know the domains that are under their tld.  You walk the tree down using a resolver.

    Where with forwarder you just ask your isp or google, then they either have it cached or they forward, or they resolve it.  Some point in the chain there will be a resolver.



  • Alright, thanks a lot :-)


Log in to reply