Unbound VS PowerDNS

dnsmasq and unbound are impacted to

https://github.com/NLnetLabs/unbound/releases/tag/release-1....

https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/20...

As are any other DNSSEC validators that followed the specifications.

Bind9 has its problems but this is not its fault this time.

Are you familiar with https://pi-hole.net/ ?

In my house I want DNS resolution to be performed by my own DNS resolver (https://github.com/NLnetLabs/unbound), after I block ad domains.

DoH circumvents that.

Gravity-Sync won't do that. But searching around on GH, I found this : https://github.com/NLnetLabs/unbound/blob/master/contrib/unbound_cache.sh

Version 1.15.0 Configure line: --with-libexpat=/usr/local --with-ssl=/usr --disable-dnscrypt --disable-dnstap --with-libnghttp2 --enable-ecdsa --disable-event-api --enable-gost --with-libevent --with-pythonmodule=yes --with-pyunbound=yes ac_cv_path_SWIG=/usr/local/bin/swig LDFLAGS=-L/usr/local/lib --disable-subnet --disable-tfo-client --disable-tfo-server --with-pthreads --prefix=/usr/local --localstatedir=/var --mandir=/usr/local/man --infodir=/usr/local/share/info/ --build=amd64-portbld-freebsd12.3 Linked libs: libevent 2.1.12-stable (it uses kqueue), OpenSSL 1.1.1n-freebsd 15 Mar 2022 Linked modules: dns64 python respip validator iterator BSD licensed, see LICENSE in source package for details. Report bugs to [email protected] or https://github.com/NLnetLabs/unbound/issues

Unbound DNS

Many users (myself included) opt to leave out third party resolvers entirely and deploy a local recursive nameserver. I use Unbound. In the default recursive operation it queries the root nameservers directly, with responses validated using DNSSEC. So there's no potential of a third party upstream providing incorrect records, either accidentally or deliberately, and no one server gets the opportunity to log the full path of your resolution chain. Your ISP, Cloudflare, Google, OpenDNS or whatever may super duper pinkie promise not to log your resolution history or use it for whatever purpose, but why give them the opportunity to?

The next logical step in this chain usually looks something like "OK, so my queries and their responses are secure, but why do I trust [my ISP/this third party/this faceless megacorporation] exactly?", and...honetly, you shouldn't. One or two more questions and the next thing you know you're running your own full recursive resolver stack.

I wasn't personally particularly happy with any one provider's offering, and didn't want to needlessly include a third party, so I stood up my own APDNS proxy with an iterating nameserver behind it.

I have nextdns CLI installed on OPNSense but I'm looking for a plugin for OPNsense since I have zero visibility with the CLI Anyone know if this is coming soon or in the works? this page says "coming soon": https://github.com/nextdns/nextdns/wiki and this says that nextdns doesn't work with with unbound: https://github.com/NLnetLabs/unbound/issues/132

If your router is compatible with custom firmware (Tomato or DD-WRT) you can flash it and use the logging features of those platforms. Otherwise no there isn't really an "app or software" that can do this, you need a piece of hardware that sits between the LAN devices and the internet connection. That can be a full-fledged computer, if you're willing to use it as firewall or router (pfSense), DNS server (PowerDNS) or proxy server (Squid).

As to the DNS part I'm still undecided, I've found some bind9 web gui I think, but seems to me bind might be overkill and maybe it's time to get over that old piece of software, and gui is separate and seems limited anyway, so still thinking about things like CoreDNS or powerDNS (https://www.powerdns.com/)

Hosting DNS is possible with something like PowerDNS

For more advanced options you could look into PowerDNS which in addition to the standard zone transfers allows you to use database replication to update zones.

powerdns/pdns

RPi CM4 with carrier board running 64-bit Ubuntu Server LTS, using Netplan for interface management, netfilter for firewall/forward, dnsmasq for DHCP (because I also use this for PXE), and PowerDNS for DNS (because I need something that I can externally update for k8s services), and WireGuard (so I can phone home easily).