Simple Unbound DNS resolver configurations for Debian.

Files

• unbound.conf — Locked-down config. Listens on 127.0.0.1 only, refuses all non-localhost access.
• open-unbound.conf — Open config. Listens on 0.0.0.0 and allows queries from any address. Use only on trusted or isolated networks.

Both configs share the same base settings: 4 threads, hourly statistics, query logging, and hidden version/identity. DNSSEC validation is commented out by default.

Install

sudo cp unbound.conf /etc/unbound/unbound.conf
sudo systemctl restart unbound

Validate the config before applying:

unbound-checkconf /etc/unbound/unbound.conf

See also

• unbound.conf(5) man page
• /usr/share/doc/unbound/examples/unbound.conf