Hello,
Just wondering if anyone is using Kea DHCP together with Unbound for default DNS resolution and Bind for local zone resolution via dynamic RFC2136 updates from Kea? This seems like an elegant way to get local resolution of DHCP-assigned addresses while using Kea instead of dnsmasq. But does it work well in practice?
Thanks!
We discussed this back and forth already and not an exact answer to your question, but:
IMHO, the easiest way is to just use Kea DHCP static reservations, where the names of the host entries can directly be used in Unbound directly when you check "Register DHCP Static Mappings". That way, there is no need for any additional DNS resolver and you can control which names are being registered, which cannot be done if the hosts themselves present their names.
The only disadvantage I can see is that you have to create static reservations for all hosts you need to be resolvable, because there is no equicalent of ISC dynamic DHCP bindings in OpnSense's implementation of Kea DHCP yet.
However, I need exactly those hosts to have static IPs as well, so I do not miss anything. Also, more often than not, I also want to have aliases for hosts, sometimes to have different services on the same one, so I need to configure those in Unbound anyway.
Quote from: meyergru on June 06, 2026, 03:33:47 PMThe only disadvantage I can see is that you have to create static reservations for all hosts you need to be resolvable, because there is no equicalent of ISC dynamic DHCP bindings in OpnSense's implementation of Kea DHCP yet.
Doesn't the new KEA DDNS feature solve that issue ?!
That is basically the OPs question. I know that the DDNS feature has been added to Kea recently, but I think that Unbound has no RFC2136 support, so you really need anther DNS server that supports it, like BIND, which makes the setup quite complex.
Quote from: meyergru on June 06, 2026, 04:59:20 PMThat is basically the OPs question.
It seems I misunderstood the whole post or something...
My bad! >_<
QuoteI know that the DDNS feature has been added to Kea recently, but I think that Unbound has no RFC2136 support, so you really need anther DNS server that supports it, like BIND, which makes the setup quite complex.
You are right : https://docs.opnsense.org/manual/kea.html#dynamic-dns-rfc2136
Should have read it first before replying... LOL!
Together with : https://kea.readthedocs.io/en/latest/arm/ddns.html
I think it should be doable to configure everything without needing any kind of HowTo/Tutorial :)
There is just one thing I don't understand :
Why is this mentioned :
QuoteKEA allows registering client FQDNs via dynamic DNS (RFC2136) to an authoritative DNS server.
Such an authoritative DNS server will be ISC BIND or an alternative like PowerDNS.
Recursive DNS servers like Dnsmasq or Unbound are not able to fulfill this role.
When clients register their IP address, the DHCP server will receive a Client FQDN (DHCP option 81) that either contains a client hostname or an FQDN. In cases where clients only send a hostname, using the DNS qualifying suffix will construct an FQDN and force an update anyway.
AFAIK one of the advantages or DNSmasqd is exactly that :
Each DHCP Client is also immediately available in the DNS part of DNSmasqd.
Feel like I have completely misunderstood here something... or not... ?!
The simplest way for this is to use Dnsmasq because it was made for exactly this purpose.
But there are very large networks where an authoritative nameserver combined with KEA makes sense, its way more scalable.
But none of these ways is inherently cleaner than the other. I would always choose the simplest way with the least moving parts, which is dnsmasq for these home/homelab style setups (I assume most who ask these questions here dont ask for an enterprise setup, because these have proper DNS infrastructure set up already which would naturally benefit from KEA.)
So instead of KEA+Unbound+Bind you can just use Dnsmasq as single unified daemon that does it all with no surprises xD
TLDR
People often underestimate operational complexity and overestimate the benefits of modularity for small deployments.
FWIW; the one thing (that I know of so far) that makes dnsmasq unsuitable for my small "home lab" environment is lack of prefix delegation support. I do use that with a sandbox instance of OPNsense behind my "production" instance.
Prefix delegation and dhcp registration into Unbound is why I am still running the ISC dhcpd. Aside from my home lab, Apple's HomeKit uses prefix delegated IPv6 addresses. I guess it assigns IPs to downstream nodes.
We just recently added dynamic prefix delegation to KEA in 26.1.9, was one of the roadmap items I worked extensively on.
But the Unbound DNS registration for dynamic hosts will most likely not come, only DHCP reservations are synced with Unbound -> which should actually be sufficient for most setups.
So overall ISC DHCP should be able to be cleanly replaced now.
Quote from: Monviech (Cedrik) on June 06, 2026, 10:17:38 PMBut the Unbound DNS registration for dynamic hosts will most likely not come, only DHCP reservations are synced with Unbound -> which should actually be sufficient for most setups.
I saw a discussion where someone got a script to do that. It is likely the direction I will go, but I figure I'll ride this ISC horse until the sun sets. :)
When using KEA I would rather go with Bind like the OP of this thread plans to do. They're like brothers in arms, ISCs own tooling (Stork) combines them both as well.
Good point. If I am considering a workaround, I should at least look at other options as well. Thanks for that suggestion.
I felt brave and decided to bite the bullet. After about 12 hours, I didn't get it all working so I caught a little hell from my wife. 😬 I think I finally got most of the fires out so below are my notes:
- I decided to break out my different VLANs (e.g. IoT) into their own forward zones. I used sub-zones in the format vlan.domain.tld. This method makes it easier to troubleshoot.
- Uncheck Register ISC DHCP4 Leases and Register DHCP Static Mappings under Services > Unbound > General to avoid creating entries in Unbound since I still have ISC dhcpd installed.
- Restarting Bind caused the zone reload to fail with journal rollforward failed: journal out of sync with zone errors in the Bind log. I used rndc sync -clean to clear out the *.jnl files before restarting. I need to find a better way since I lose DDNS entries without the journal. I tried rndc stop and rndc freeze before clicking Save and neither fixed it.
- Under each Kea subnet DDNS setting, I had to end the forward and reverse zones, and qualifying suffix fields with a dot (.). Otherwise, Bind could not find the correct zone to update.
- I got DDNS update failures with 'RRset exists (value dependent)' errors in Bind for devices that are IPv4+IPv6 dual stack. I think this is due to both using the same DHCID and it became a race to create the first record. I set no-check-with-dhcid in each Kea subnet to fix it.
- My gateway was named "gw.vlan.domain.tld". Even when Unbound is set to forward all vlan.domain.tld queries to Bind, it refused to forward this one. I had to change my gateway domain name under System > Settings > General > Domain to something else.
- Some devices (OpenWRT) only send host names to Kea. This is what "DNS qualifying suffix" was supposed to fix. That setting worked for IPv4 but not IPv6; maybe OpenWRT sent FQDNs on IPv4 but I did not check. Kea logs showed No DNS servers match FQDN hostname. Reserving their IPv6 address fixed it. I think this issue is with upstream but that requires confirmation. Any IPv6 lease that is not FQDN under the Hostname column needs this reservation.
- I used dig @x.x.x.x -p 53530 name to query Bind directly. Otherwise, I got Unbound's cached entry.
- Once everything is confirmed to work, I set Bind to listen on 127.0.0.1 and ::1 so networks cannot query it directly.
So far so good. I had to create some CNAME records for our printer and SIP proxy. This gets Windows and desk phone working until I get time to reconfigure them and switch to using their IoT names instead.
OP here. Thanks to all for sharing your viewpoints and experiences.
My network is small - a home network with about 40 devices total, and IPv6 dual stack. I don't NEED Kea - I just thought it might be fun to try to set it up with dynamic DNS entries via Bind. However, @Monviech's point not to overcomplicate is well taken. I'm currently using dnsmasq for DHCP + local DNS, and Unbound for upstream recursive DNS queries which dnsmasq does not support (I prefer going directly to the authoritative DNS servers rather than relying on my ISP's DNS). To switch to the solution I inquired about in my OP, I would need (1) Kea, (2) radvd for IPv6 router advertisements, (3) Unbound for recursive DNS, and (4) Bind for local DNS. This is a more complex solution with a lot more moving parts (to use Monviech's wording).
Thus, after further consideration, and also after seeing the various issues encountered by @allan, I've decided to leave things alone for now and avoid an angry wife and daughters 😯. So it's dnsmasq --> Unbound.
Thanks all!
-cinergi
OP, if you ever decide to go down this path, I suggest to first set up Monit to watch log files and run a script based on keywords. When you see journal rollforward failed, that means Bind did not load that zone file. Your static DNS assignments in addition to Kea DDNS registrations are all offline at that point. Internet through Unbound still works but no LAN devices are resolvable. You need Monit to watch for that, quickly delete those journal files and restart Bind to recover before anyone notices. Until there is a better way, that is how I have it set up. I actually match on zone not loaded as my keyword.
@Allan
I feel like you ran into this here:
https://github.com/opnsense/plugins/pull/5102
Sounds like an external Bind server might be better, I don't know if this can be reasonably fixed in the plugin.
If your workarounds work, well, that's good though, nice job figuring this all out.
@cinergi
Keeping it simple in your setup sounds indeed like the best plan. The configuration we recommend is this:
https://docs.opnsense.org/manual/dnsmasq.html#dhcpv4-with-dns-registration
Good choice :)
Quote from: Monviech (Cedrik) on June 08, 2026, 09:06:36 AM@cinergi
Keeping it simple in your setup sounds indeed like the best plan. The configuration we recommend is this:
https://docs.opnsense.org/manual/dnsmasq.html#dhcpv4-with-dns-registration
Good choice :)
Now that you mention it...
Why is this :
Quote from: cinergi on June 08, 2026, 03:04:45 AMSo it's dnsmasq --> Unbound.
Not the default setup ?!
When using DNSmasqd for DHCP and DNS it would be a lot more easier for a lot of people if Unbound was not used as the Primary DNS Resolution and instead just for talking to the Root DNS Servers after DNSmasqd sends it a DNS Query made by a Client on a local network.
Most users also want to use Unbound statistics or blocklists by subnet and then it would only show Dnsmasq as its only client (127.0.0.1)
Unbound cannot use magic like dnsmasqs "add-subnet" or "add-mac" which extract the real IP address of the client when the request is forwarded by another dns server.
So having Unbound as main entry point has more benefits.
Also the project owner simply calls it "dnsmasq" https://thekelleys.org.uk/dnsmasq/docs/dnsmasq-man.html
Quote from: Monviech (Cedrik) on June 08, 2026, 09:06:36 AMI feel like you ran into this here:
https://github.com/opnsense/plugins/pull/5102
Sounds like an external Bind server might be better, I don't know if this can be reasonably fixed in the plugin.
If your workarounds work, well, that's good though, nice job figuring this all out.
Thank you! This is indeed what I am bumping into. I wonder if it is possible to write DDNS changes into a separate zone file. That way, the journal can monitor that file instead.
Hi all — I've been following this topic and wanted to share something I built that I think addresses exactly this problem.
**os-kea-ubnd-ddns** is an OPNsense plugin that bridges Kea DHCP → Unbound DNS directly, without Bind. It runs a lightweight RFC 2136 stub listener that receives DNS UPDATE packets from `kea-dhcp-ddns` and applies them to Unbound via `unbound-control` — so you get real-time hostname registration when a lease is issued - no zone files, no journal corruption, no `.jnl` cleanup.
**What it solves from this thread specifically:**
- No Bind required — Unbound stays the primary resolver, so blocklists and per-client analytics work normally
- No journal files or `rndc sync -clean` — Unbound `local_data` is ephemeral and gets rebuilt from Kea on restart
- IPv4 and IPv6 (A, AAAA, PTR) all handled — including dual-stack hosts where the same hostname has both an A and AAAA record
- The "RRset exists" race condition doesn't apply — the listener processes one UPDATE at a time and Unbound's local_data is not authoritative in the RFC 2136 sense
There's also a **Config Check** tab that reads your live Kea config and flags common mistakes (missing trailing dots on zone names, subnets with DDNS disabled, kea-dhcp-ddns listener state) — and a one-click **Configure All Subnets** button that pushes the correct DDNS settings to every subnet automatically.
Tested on OPNsense 26.1 with Kea DHCP4 and DHCP6. Current version is 0.96.
GitHub: https://github.com/tkreagan/os-kea-ubnd-ddns
Pre-built package on the releases page — `pkg add os-kea-ubnd-ddns-0.96.pkg`, no package repo needed.
Happy to answer questions here but GitHub issues might be easier.
Quote from: Monviech (Cedrik) on June 08, 2026, 08:07:47 PMMost users also want to use Unbound statistics or blocklists by subnet and then it would only show Dnsmasq as its only client (127.0.0.1)
Unbound cannot use magic like dnsmasqs "add-subnet" or "add-mac" which extract the real IP address of the client when the request is forwarded by another dns server.
So having Unbound as main entry point has more benefits.
IMHO there are better tools for the job like Pi-Hole but to each his/her own I guess :)
Quote from: tkreagan on June 15, 2026, 09:25:12 PMHi all — I've been following this topic and wanted to share something I built that I think addresses exactly this problem.
**os-kea-ubnd-ddns** is an OPNsense plugin that bridges Kea DHCP → Unbound DNS directly, without Bind.
Happy to answer questions here but GitHub issues might be easier.
Start a seperate topic about it and link to it in your post ;)
Quote from: tkreagan on June 15, 2026, 09:25:12 PMHi all — I've been following this topic and wanted to share something I built that I think addresses exactly this problem.
**os-kea-ubnd-ddns** is an OPNsense plugin that bridges Kea DHCP → Unbound DNS directly, without Bind. It runs a lightweight RFC 2136 stub listener that receives DNS UPDATE packets from `kea-dhcp-ddns` and applies them to Unbound via `unbound-control` — so you get real-time hostname registration when a lease is issued - no zone files, no journal corruption, no `.jnl` cleanup.
This looks pretty neat, I'll take a look.