Pi-hole Unbound Setup: 5 Steps to Private DNS

You set up Pi-hole, the ads vanished, and life got better. But here’s the part most guides skip: your Pi-hole is still forwarding every DNS lookup to Google or Cloudflare, which means someone out there still sees every domain your house visits. A proper pi-hole unbound setup fixes that — it turns your Pi into its own recursive DNS resolver, so your browsing history stops leaving your network entirely. The full Pi-hole Unbound setup takes about thirty minutes, and you only ever have to do it once.

I added Unbound to my Pi-hole a while back expecting it to be a pain. It took about ten minutes. And the payoff is real privacy: no third-party DNS provider logging what you look up, plus a nice side benefit of DNSSEC validation for free.

Why does this matter if you already block ads? Because blocking and privacy are two different things. Pi-hole blocks the junk, but on its own it still asks an outside company to resolve every site you visit — and that company can log it. Unbound cuts the middleman: your network resolves domains itself, straight from the authoritative servers. It’s the difference between hiding your mail and not mailing it through a company that reads the envelopes.

	Plain Pi-hole (Upstream DNS)	Pi-hole + Unbound
Who sees your DNS queries	Your chosen upstream (Google, Cloudflare, etc.)	Nobody outside your network
DNSSEC validation	Depends on the upstream	Done locally, cryptographically
Repeat lookups	Fast (upstream cache)	Fast (your own cache)
First lookup to a new domain	Fast (upstream already resolved it)	Slightly slower (Unbound walks the tree itself)
Setup time	Already done	~10 extra minutes

What You Need First

This builds on a working Pi-hole install. If you don’t have one yet, start with my guide to self-hosting Pi-hole first, then come back here. Not sure whether to run Pi-hole or AdGuard? My AdGuard Home vs Pi-hole comparison breaks it down.

Hardware-wise, Pi-hole and Unbound together are featherlight — they’ll run on almost any Raspberry Pi. I run mine on a Raspberry Pi alongside a few other services, and the Raspberry Pi 5 (8GB) is the one I’d buy today if you want room to grow into a real home server.

One thing worth doing right: use a quality, high-endurance card. A flaky microSD is the #1 cause of “my Pi-hole randomly stopped working.” The SanDisk Extreme 128GB microSD is fast, reliable, and cheap insurance.

Pi-hole Unbound Setup: 5 Steps

Run these on the same machine your Pi-hole lives on.

1. Install Unbound. One command:

sudo apt install unbound -y

2. Create the Unbound config. Make a new file at /etc/unbound/unbound.conf.d/pi-hole.conf with these settings (this tells Unbound to listen on port 5335 and resolve recursively):

server:
    interface: 127.0.0.1
    port: 5335
    do-ip6: no
    harden-glue: yes
    harden-dnssec-stripped: yes
    edns-buffer-size: 1232
    prefetch: yes
    private-address: 192.168.0.0/16
    private-address: 172.16.0.0/12
    private-address: 10.0.0.0/8

3. Restart Unbound.

sudo service unbound restart

4. Test it. This should return an IP address — proof Unbound is resolving on its own:

dig pi-hole.net @127.0.0.1 -p 5335

5. Point Pi-hole at Unbound. In the Pi-hole admin panel, go to Settings → DNS, uncheck every upstream provider, and add a custom one:

127.0.0.1#5335

Save, and you’re done. Pi-hole now sends every query to your local Unbound resolver instead of a third party.

Did It Work?

Visit the DNSSEC test at Pi-hole’s official Unbound guide (which also has the full config reference) and confirm validation passes. From here, your whole network resolves DNS privately. If you’re running this as part of a bigger stack, it slots neatly alongside a Docker Compose home server.

Keeping It Healthy: The 5-Minute Maintenance Routine

Once Unbound is answering queries, it mostly disappears — but two small habits keep the setup bulletproof. First, updates: Unbound comes from your Pi’s package manager, so the same apt update && apt upgrade you (hopefully) already run covers it. No separate update dance.

Second, the root hints file — the list of root servers Unbound starts from — changes rarely, but “rarely” isn’t “never.” Re-downloading it a couple of times a year keeps cold lookups on the fastest path. Set a calendar reminder or a cron job and forget about it.

While you’re in there, it’s worth glancing at cache statistics with unbound-control stats_noreset if you enabled remote control — watching the cache hit rate climb past 80% is the nerd equivalent of checking your investment portfolio, except this one always goes up.

Quick Answers: Pi-hole Unbound FAQ

Will running my own resolver slow browsing down? The first visit to a brand-new domain takes slightly longer — Unbound walks the DNS tree itself instead of asking an upstream server that already knows. But every answer gets cached, so repeat lookups come back in a millisecond or two from your own network. In day-to-day browsing the difference is imperceptible, and popular sites are effectively always cached. You traded a few milliseconds on cold lookups for nobody logging your DNS history — comfortably the best trade in networking.

How is this more private if root servers still see my queries? The root and authoritative servers see fragments — one asks “who handles .com?”, another “where’s example.com?” — but no single party sees your full browsing pattern with your IP attached, which is exactly what an upstream DNS provider gets. With this pi-hole unbound setup, the complete picture of what your household looks up exists in precisely one place: your own Pi.

Do I still need DNSSEC validation turned on? Yes, and the config in this guide enables it. Unbound validates signatures itself, so you’re no longer trusting an upstream’s word that a record is authentic — you’re checking cryptographically. That protects against DNS spoofing on networks you don’t fully control.

What breaks if the Pi goes down? DNS for the whole network — which sounds dramatic but has a simple mitigation: run a second Pi-hole (an old Pi Zero works) as the secondary DNS in your router’s DHCP settings, or at minimum know how to point your router back at a public resolver in a pinch. Homelab rule: anything the family depends on deserves a fallback.

How do I know it’s actually working? Two checks: dig example.com @127.0.0.1 -p 5335 on the Pi should return answers, and Pi-hole’s dashboard should show 127.0.0.1#5335 as its only upstream. For the skeptical, watch the query log while browsing — you’ll see Unbound resolving fresh domains and answering repeats from cache, which is the whole system working as designed.

The Takeaway

A pi-hole unbound setup is the natural next step after you’ve blocked ads — it closes the privacy gap that plain Pi-hole leaves open. Ten minutes, five steps, and your browsing history stops being someone else’s data. If you care enough to block ads at the network level, you care enough to do this too.

Running Pi-hole with Unbound already? Tell me what other privacy tweaks you’ve layered on — I’m always looking to harden my setup further.

And that’s the quiet satisfaction of this whole project: for the cost of an evening and zero dollars, every device in your house now resolves DNS through hardware you own, validated cryptographically, logged nowhere but your own dashboard. The pi-hole unbound setup is the rare privacy upgrade that’s also a performance upgrade — and once it’s running, it simply never asks for attention again. Set the maintenance reminders, enjoy the cache hits, and cross “DNS provider” off the list of companies that know your business. That’s the entire Pi-hole Unbound setup — private DNS, faster repeat lookups, and one less company profiling your traffic.