Learning about Unbound

[hushcoden]

I read an interesting article here and my current configuration is pretty similar with the one in the article is "example 2", i.e. DoT, recursive caching DNS, TCP port 853 and DNSSEC.

There is an "example 3" (Authoritative, validating, recursive caching DNS) and I've noticed a few differences. i.e. there are no upstream servers, the listening interface/address is only 127.0.0.1, there is no DoT - I'm trying to understand if there is a real benefit in using this third configuration...

How do you configure Unbound ? Keen to hear (and learn) from the experts of this subject, thanks.

[Maurice]

When using upstream DoT, unbound forwards all queries to the configured DoT provider. Pros: Your ISP can't see or manipulate your DNS queries. Cons: The DoT provider can see and manipulate all your DNS queries. And the DoT provider is a single point of failure.

When running it as a recursive resolver, all queries are handled by unbound itself. Pros: There is no third party which can see and manipulate all your DNS queries. And there is no single point of failure. Cons: Your ISP can see and manipulate all your DNS queries.

So it comes down to who you trust less: Your ISP or some third party DoT provider.

(I run unbound as a recursive resolver because my ISP doesn't have a history of messing with DNS.)

[hushcoden]

Thanks Maurice, I'm so intrigued to learn more about this topic...

According to that article you ave set up Unbound as a caching DNS, a recursive caching DNS, a validating recursive caching DNS, an authoritative validating recursive caching DNS, etc... wil get there 

And I believe Unbound acts as a recursive caching DNS server?

Also, I read that to set up Unbound as authoritative, validating, recursive caching DNS server, the listening interface/address is 127.0.0.1, but I can't find that option: you can only chose between your LANs and WAN interfaces...

And sorry if I'm messing up things, I'm learning... 

[Maurice]

Disclaimer: I didn't read the linked article.

"Caching" just means unbound caches results so queries don't have to be resolved / forwarded over and over again.
"Recursive" means unbound resolves queries itself and doesn't just forward them. If you use upstream DoT, unbound is NOT a recursive resolver, but a forwarder.
"Validating" means unbound verifies DNSSEC records.
"Authoritative" only applies to zones hosted by unbound itself. In OPNsense, this is typically only your local domain configured in the system settings.

In your config, unbound is a "caching validating forwarder".

The listening interfaces are not relevant for any of these.

[hushcoden]

So, since I pretty much trust my ISP, I can delete the forward-zone: section, right?

Also, can I delete the line tls-cert-bundle: /etc/ssl/cert.pem from the section server: or it's used by something else too ?

[Maurice]

unbound.conf shouldn't be edited manually at all. It gets recreated whenever you make changes in the Web GUI.