You set up Pi-hole, the ads vanished, and life got better. But here’s the part most guides skip: your Pi-hole is still forwarding every DNS lookup to Google or Cloudflare, which means someone out there still sees every domain your house visits. A proper pi-hole unbound setup fixes that — it turns your Pi into its own recursive DNS resolver, so your browsing history stops leaving your network entirely.
I added Unbound to my Pi-hole a while back expecting it to be a pain. It took about ten minutes. And the payoff is real privacy: no third-party DNS provider logging what you look up, plus a nice side benefit of DNSSEC validation for free.
Why does this matter if you already block ads? Because blocking and privacy are two different things. Pi-hole blocks the junk, but on its own it still asks an outside company to resolve every site you visit — and that company can log it. Unbound cuts the middleman: your network resolves domains itself, straight from the authoritative servers. It’s the difference between hiding your mail and not mailing it through a company that reads the envelopes.
What You Need First
This builds on a working Pi-hole install. If you don’t have one yet, start with my guide to self-hosting Pi-hole first, then come back here. Not sure whether to run Pi-hole or AdGuard? My AdGuard Home vs Pi-hole comparison breaks it down.
Hardware-wise, Pi-hole and Unbound together are featherlight — they’ll run on almost any Raspberry Pi. I run mine on a Raspberry Pi alongside a few other services, and the Raspberry Pi 5 (8GB) is the one I’d buy today if you want room to grow into a real home server.
One thing worth doing right: use a quality, high-endurance card. A flaky microSD is the #1 cause of “my Pi-hole randomly stopped working.” The SanDisk Extreme 128GB microSD is fast, reliable, and cheap insurance.
- Compatible with Nintendo-Switch (NOT Nintendo-Switch 2)
- Save time with card offload speeds of up to 190MB/s powered by SanDisk QuickFlow Technology (Up to 190MB/s read speeds, engineered with proprietary technology to reach speeds beyond UHS-I 104MB/s, requires compatible devices capable of reaching such speeds. Based on internal testing; performance may be lower depending upon host device interface, usage conditions and other factors. 1MB=1,000,000 bytes. SanDisk QuickFlow Technology is only available for 64GB, 128GB, 256GB, 400GB, 512GB, and 1TB capacities. 1GB=1,000,000,000 bytes and 1TB=1,000,000,000,000 bytes. Actual user storage less.)
- Pair with the SanDisk Professional PRO-READER SD and microSD to achieve maximum speeds (sold separately)
- Up to 90MB/s write speeds for fast shooting (Based on internal testing; performance may be lower depending upon host device interface, usage conditions and other factors. 1MB=1,000,000 bytes.)
- 4K and 5K UHD-ready with UHS Speed Class 3 (U3) and Video Speed Class 30 (V30) (Compatible device required. Full HD (1920x1080), 4K UHD (3840 x 2160), and 5K UHD (5120 X 2880) support may vary based upon host device, file attributes and other factors. See HD page on SanDisk site. UHS Speed Class 3 (U3) designates a performance option designed to support real-time video recording with UHS-enabled host devices. Video Speed Class 30 (V30), sustained video capture rate of 30MB/s, designates a performance option designed to support real-time video recording with UHS-enabled host devices. See the SD Association’s official website.)
Pi-hole Unbound Setup: 5 Steps
Run these on the same machine your Pi-hole lives on.
1. Install Unbound. One command:
sudo apt install unbound -y2. Create the Unbound config. Make a new file at /etc/unbound/unbound.conf.d/pi-hole.conf with these settings (this tells Unbound to listen on port 5335 and resolve recursively):
server:
interface: 127.0.0.1
port: 5335
do-ip6: no
harden-glue: yes
harden-dnssec-stripped: yes
edns-buffer-size: 1232
prefetch: yes
private-address: 192.168.0.0/16
private-address: 172.16.0.0/12
private-address: 10.0.0.0/83. Restart Unbound.
sudo service unbound restart4. Test it. This should return an IP address — proof Unbound is resolving on its own:
dig pi-hole.net @127.0.0.1 -p 53355. Point Pi-hole at Unbound. In the Pi-hole admin panel, go to Settings → DNS, uncheck every upstream provider, and add a custom one:
127.0.0.1#5335Save, and you’re done. Pi-hole now sends every query to your local Unbound resolver instead of a third party.
Did It Work?
Visit the DNSSEC test at Pi-hole’s official Unbound guide (which also has the full config reference) and confirm validation passes. From here, your whole network resolves DNS privately. If you’re running this as part of a bigger stack, it slots neatly alongside a Docker Compose home server.
Keeping It Healthy: The 5-Minute Maintenance Routine
Once Unbound is answering queries, it mostly disappears — but two small habits keep the setup bulletproof. First, updates: Unbound comes from your Pi’s package manager, so the same apt update && apt upgrade you (hopefully) already run covers it. No separate update dance.
Second, the root hints file — the list of root servers Unbound starts from — changes rarely, but “rarely” isn’t “never.” Re-downloading it a couple of times a year keeps cold lookups on the fastest path. Set a calendar reminder or a cron job and forget about it.
While you’re in there, it’s worth glancing at cache statistics with unbound-control stats_noreset if you enabled remote control — watching the cache hit rate climb past 80% is the nerd equivalent of checking your investment portfolio, except this one always goes up.
Quick Answers: Pi-hole Unbound FAQ
Will running my own resolver slow browsing down? The first visit to a brand-new domain takes slightly longer — Unbound walks the DNS tree itself instead of asking an upstream server that already knows. But every answer gets cached, so repeat lookups come back in a millisecond or two from your own network. In day-to-day browsing the difference is imperceptible, and popular sites are effectively always cached. You traded a few milliseconds on cold lookups for nobody logging your DNS history — comfortably the best trade in networking.
How is this more private if root servers still see my queries? The root and authoritative servers see fragments — one asks “who handles .com?”, another “where’s example.com?” — but no single party sees your full browsing pattern with your IP attached, which is exactly what an upstream DNS provider gets. With this pi-hole unbound setup, the complete picture of what your household looks up exists in precisely one place: your own Pi.
Do I still need DNSSEC validation turned on? Yes, and the config in this guide enables it. Unbound validates signatures itself, so you’re no longer trusting an upstream’s word that a record is authentic — you’re checking cryptographically. That protects against DNS spoofing on networks you don’t fully control.
What breaks if the Pi goes down? DNS for the whole network — which sounds dramatic but has a simple mitigation: run a second Pi-hole (an old Pi Zero works) as the secondary DNS in your router’s DHCP settings, or at minimum know how to point your router back at a public resolver in a pinch. Homelab rule: anything the family depends on deserves a fallback.
How do I know it’s actually working? Two checks: dig example.com @127.0.0.1 -p 5335 on the Pi should return answers, and Pi-hole’s dashboard should show 127.0.0.1#5335 as its only upstream. For the skeptical, watch the query log while browsing — you’ll see Unbound resolving fresh domains and answering repeats from cache, which is the whole system working as designed.
The Takeaway
A pi-hole unbound setup is the natural next step after you’ve blocked ads — it closes the privacy gap that plain Pi-hole leaves open. Ten minutes, five steps, and your browsing history stops being someone else’s data. If you care enough to block ads at the network level, you care enough to do this too.
Running Pi-hole with Unbound already? Tell me what other privacy tweaks you’ve layered on — I’m always looking to harden my setup further.
And that’s the quiet satisfaction of this whole project: for the cost of an evening and zero dollars, every device in your house now resolves DNS through hardware you own, validated cryptographically, logged nowhere but your own dashboard. The pi-hole unbound setup is the rare privacy upgrade that’s also a performance upgrade — and once it’s running, it simply never asks for attention again. Set the maintenance reminders, enjoy the cache hits, and cross “DNS provider” off the list of companies that know your business.