Private DNS with Unbound, and proving it rejects fakes

Goal

Stop one company seeing every website I look up, and refuse forged answers

Result

Fake answers refused

Tools

Pi-hole, Unbound, DNSSEC, dig

The problem

Pi-hole blocks ads by answering DNS lookups (turning names like google.com into addresses). For everything it doesn't block, it was asking Google or Cloudflare, so one company saw every website my devices looked up.

What Unbound does

Unbound is a recursive resolver. Instead of asking someone else, it asks the root DNS servers, then the .com servers, then the website's own server. It also checks DNSSEC signatures, so if someone forges an answer, it gets rejected. It only listens on the Pi itself, so I didn't have to open any new firewall ports.

Testing before switching over

I tested Unbound directly before pointing Pi-hole at it, so a mistake couldn't break DNS for my devices.

# a domain with valid DNSSEC: the "ad" flag means authenticated
$ dig dnssec.works @127.0.0.1 -p 5335
;; flags: qr rd ra ad

# a domain with deliberately broken DNSSEC
$ dig fail01.dnssec.works @127.0.0.1 -p 5335
;; status: SERVFAIL

SERVFAIL is the right answer: the signature is wrong, so Unbound refuses to give an address at all instead of handing over a possibly faked one.

Blocking more

Later I added HaGeZi's Pro list and its Threat Intelligence Feed, taking Pi-hole from about 71,500 blocked domains to 851,589, including known malware and phishing sites. My first try failed with "Not found" because HaGeZi had moved its files.

What I learned

• Recursive DNS removes the middleman, but your ISP can still see where you connect. Privacy is layers, not one switch.
• Test a new piece on its own before putting it in front of everything else.

How I used AI: Claude gave me the Unbound config and the dig tests. I installed it, ran the tests and switched Pi-hole over. The full, unedited notes are in my build log.