DNS Security with Unbound in 2026 (Updated May 2026)

Unbound ≥1.25.1 DNSSEC/DoT/DoH/DoQ 25 min read openSUSE Tumbleweed

By Marc — Editor at SafeITExperts | Published June 21, 2025 — Updated May 26, 2026

Introduction — Unbound in 2026: State of Play

Unbound is a validating, recursive, and caching DNS resolver developed by NLnet Labs, designed for both speed and security. This guide presents the critical configurations to secure Unbound ≥1.25.1, covering the following four pillars.

May 2026 CVE Fixes

CVE-2026-32792 (DoS), CVE-2026-33278 (DNSSEC validation) — mandatory updates for Unbound ≥1.25.1.

Modern Encryption Protocols

DoT, DoH, DoQ with functional examples and warnings against common configuration mistakes.

System Hardening

SELinux, Firewalld, chroot confinement — step-by-step guide for openSUSE Tumbleweed.

Scenario-Based Approach

Tailored configurations: domestic, SME, enterprise — choose according to your context.

Critical fix applied
The global tls-upstream: yes setting breaks DNS resolution to non-DoT root servers. This guide now uses forward-tls-upstream inside explicit forward-zone stanzas. See Modern Encryption.

Required version: Unbound ≥ 1.25.1 MAY 2026

Released on May 20, 2026 by NLnet Labs, this version fixes 11 vulnerabilities including CVE-2026-33278 (CVSS 9.8). Source: NLnet Labs

Check command

openSUSE — Verification & Installation

# Check the version on openSUSE Tumbleweed

$ zypper search --details unbound

# Install / update

$ sudo zypper refresh && sudo zypper install unbound

CVE-2026-32792: DNSCrypt Denial of Service CVSS 7.5

If Unbound is compiled with DNSCrypt, an attacker can cause a denial of service via malformed queries. Fix: update to 1.25.1. NVD

CVE-2026-33278: DNSSEC Pointer Corruption CVSS 9.8

Critical vulnerability in the DNSSEC validator that could allow remote code execution. Impact: resolver compromise. Fix: 1.25.1 imperative. CIRCL

CVE-2026-42960: Cache Poisoning CVSS 8.1

Malformed authority records can corrupt the cache. Mitigation: enable harden-below-nxdomain and harden-glue. Ubuntu USN

openSUSE Tumbleweed Specifics

• Config path: /etc/unbound/unbound.conf
• Working directory: /var/lib/unbound/
• System user: unbound:unbound
• SELinux: default unbound_t policy
• Recommended repo: server:dns for latest versions

Repo check

Repository server:dns

# Add the server:dns repo if needed

$ sudo zypper addrepo --refresh https://download.opensuse.org/repositories/server:/dns/openSUSE_Tumbleweed/ server:dns

$ sudo zypper refresh

Essential Configuration for Unbound ≥1.25.1

This section details configuration options validated by the official unbound.conf(5) manpage v1.25.1. Defaults and recommendations have been verified for this version.

auto-trust-anchor-file Not set by default

Default: none. Recommendation: "/var/lib/unbound/root.key". Enables automatic DNSSEC validation with periodic trust anchor updates. Source: unbound.conf(5) manpage.

harden-below-nxdomain yes (default since 1.8.0)

Actual default: yes (since 1.8.0, 2018). RFC 8020 compliant — cache poisoning protection. The audit incorrectly reported no (based on an older version).

harden-glue yes (default)

Default: yes. Strict validation of glue records. Recommended: yes. Essential protection against cache poisoning attacks.

hide-identity / hide-version no (default)

Default: no. Recommendation: yes. Hides the server identity and version to reduce the attack surface.

private-address None configured by default

Recommendation: configure RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and 169.254.0.0/16. Blocks private addresses in public responses — DNS rebinding protection.

access-control 127.0.0.0/8 only

Default: only localhost is allowed. Recommendation: add local subnets (e.g., 192.168.0.0/16 allow). Restricts queries to trusted networks.

qname-minimisation yes (default)

Default: yes. Reduces data sent to upstream servers to improve privacy. RFC 7816 compliant.

edns-buffer-size 1232 (default since 1.12.0)

Actual default: 1232 (DNS Flag Day 2020). Avoids UDP fragmentation, required for DoT/DoH. Recommendation: 1232.

prefetch no → yes

Default: no. Recommendation: yes. Pre-fetches cache entries before expiration (~10% traffic increase, but improved latency).

rrset-roundrobin yes (default since 1.11.0)

Actual default: yes (since 1.11.0, 2020). RRSet rotation for load balancing. The audit incorrectly reported no.

use-caps-for-id no (default) — Not recommended for production

Default: no. Recommendation: no (except for testing). 0x20 randomization can cause SERVFAIL with some upstream resolvers. Official documentation and field experience advise against this option in production.

Best practice
Always check actual defaults via unbound-control dump_config or the unbound.conf(5) manpage for your installed version. Defaults have evolved across versions: harden-below-nxdomain switched to yes in 1.8.0, rrset-roundrobin in 1.11.0, edns-buffer-size to 1232 in 1.12.0.

Modern Encryption: DoT / DoH / DoQ

In 2026, DNS transport encryption is no longer optional. Unbound natively supports three protocols.

DNS-over-TLS (DoT) — Port 853 TCP NATIVE

Native TLS encryption, dedicated port. Compatible with all major public resolvers (Quad9, Cloudflare, Google). Google DoT, Quad9, Cloudflare

Recommended configuration

unbound.conf — forward-zone DoT

forward-zone:

forward-addr: 9.9.9.9@853#dns.quad9.net

forward-addr: 149.112.112.112@853#dns.quad9.net

forward-tls-upstream: yes # ← ONLY here!

tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"

tls-protocols: "TLSv1.3"

tls-cipher-list: "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"

⚠️ Do not use global tls-upstream: yes DANGER

Applying this directive in the server: block forces TLS for all outgoing queries, including to root servers that do not support it. Result: immediate resolution failure.

DNS-over-HTTPS (DoH) — Port 443 HTTPS PROXY REQUIRED

Unbound does not support DoH natively as a client. Two possible architectures:

Option 1: Local proxy with doh-proxy

unbound.conf — doh-proxy

# Install doh-proxy (NLnet Labs)

$ sudo zypper install unbound-doh-proxy

# Minimal configuration in /etc/unbound/unbound.conf

server:

interface: 127.0.0.1@5353 # Listen on alternate port

forward-zone:

forward-addr: 9.9.9.9@443#dns.quad9.net

forward-https-upstream: yes

Option 2: Server-side termination with Caddy

Caddyfile — DoH Upstream

# Minimal Caddyfile to serve DoH locally

localhost:443 {

reverse_proxy /dns-query {

to localhost:5353

header_up Host {host}

}

tls internal

}

DNS-over-QUIC (DoQ) — Port 853 UDP NATIVE ≥1.22.0

Native support since Unbound ≥1.22.0. More resistant to blocking than DoT. Quad9 and Cloudflare have activated DoQ in production in 2026. RFC 9250

Minimal configuration

unbound.conf — DoQ (DNS-over-QUIC)

server:

quic-port: 853 # UDP

tls-service-key: "/etc/unbound/doq.key"

tls-service-pem: "/etc/unbound/doq.pem"

tls-protocols: "TLSv1.3"

# To use a DoQ upstream:

forward-zone:

forward-addr: 9.9.9.9@853#dns.quad9.net

forward-ssl-upstream: yes # alias for DoQ

⚠️ Technical prerequisites CHECK

• OpenSSL ≥ 3.5.0
• libngtcp2 ≥ 1.13.0
• Verify: ldd /usr/sbin/unbound | grep ngtcp2

System Hardening: openSUSE Tumbleweed

SELinux: allow outgoing DoT/DoQ traffic

By default, the unbound_t policy may block connections to ports 853. Here's how to open them:

SELinux commands

SELinux — DoT/DoQ Policies

# Allow Unbound to initiate connections to port 853 (DoT/DoQ)

$ sudo semanage port -a -t unbound_port_t -p tcp 853 2>/dev/null || \

$ sudo semanage port -m -t unbound_port_t -p tcp 853

# If using DoQ (UDP)

$ sudo semanage port -a -t unbound_port_t -p udp 853 2>/dev/null || \

$ sudo semanage port -m -t unbound_port_t -p udp 853

# Reload policy

$ sudo restorecon -Rv /etc/unbound /var/lib/unbound

Firewalld: minimal rules

Open the necessary ports for DNS service and outgoing encrypted connections.

Firewalld commands

Firewalld — DoT/DoQ Rules

# Incoming DNS (UDP/TCP 53)

$ sudo firewall-cmd --permanent --add-service=dns

# Outgoing DoT/DoQ (if not covered by trusted zone)

$ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" destination address="0.0.0.0/0" port port="853" protocol="tcp" accept'

$ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" destination address="0.0.0.0/0" port port="853" protocol="udp" accept'

$ sudo firewall-cmd --reload

Confinement: chroot and dedicated user

chroot confinement is not active by default (empty string). Configure it to isolate Unbound from the rest of the system.

chroot configuration

unbound.conf — chroot Hardening

# In /etc/unbound/unbound.conf.d/hardening.conf

server:

username: "unbound"

chroot: "/var/lib/unbound"

directory: "/var/lib/unbound"

pidfile: "/var/run/unbound.pid"

# Prepare chroot (run once)

$ sudo mkdir -p /var/lib/unbound/etc/ssl/certs

$ sudo cp /etc/ssl/certs/ca-certificates.crt /var/lib/unbound/etc/ssl/certs/

$ sudo chown -R unbound:unbound /var/lib/unbound

Verification

systemd — Unbound Service Status

$ sudo systemctl status unbound

$ sudo journalctl -u unbound -f

Deployment Scenarios: Tailoring the Configuration

🏠 Home server

Goal: basic privacy, DNS tracking protection
Encryption: DoT to Quad9 or Cloudflare
Performance: defaults sufficient
Monitoring: local logs (journalctl -u unbound)

Minimal configuration

unbound.conf — Home Profile

server:

interface: 127.0.0.1

port: 53

access-control: 127.0.0.0/8 allow

access-control: 192.168.1.0/24 allow

hide-identity: yes

hide-version: yes

qname-minimisation: yes

private-address: 10.0.0.0/8

private-address: 172.16.0.0/12

private-address: 192.168.0.0/16

private-address: fd00::/8

private-address: fe80::/10

edns-buffer-size: 1232

prefetch: yes

forward-zone:

forward-addr: 9.9.9.9@853#dns.quad9.net

forward-tls-upstream: yes

tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"

🏢 Small business (10-50 users)

Goal: enhanced security, centralized logging
Encryption: DoT + DoQ fallback
Performance: num-threads: 2, msg-cache-size: 50m
Monitoring: via unbound-control stats

SME-specific adjustments

unbound.conf — SMB Profile

server:

num-threads: 2

msg-cache-size: 50m

rrset-cache-size: 100m

unwanted-reply-threshold: 50000 # ~1% of estimated hourly traffic

harden-referral-path: yes

minimal-responses: yes

aggressive-nsec: yes

🏭 Large enterprise / Critical infrastructure

Goal: compliance, resilience, DNS intrusion detection
Architecture: Unbound cluster + redundant forwarders
Encryption: DoT/DoQ with internal PKI certificates
Performance: msg-cache-size: 100m, rrset-cache-size: 200m (recommended for heavy load)

Advanced architecture elements

unbound.conf — Enterprise Profile

# Cluster: replicate configuration across multiple nodes

# Load balancing: use keepalived or an external load balancer

# Redundant forwarders with priorities

forward-zone:

forward-addr: 9.9.9.9@853#dns.quad9.net

forward-addr: 1.1.1.1@853#cloudflare-dns.com

forward-addr: 8.8.8.8@853#dns.google

forward-tls-upstream: yes

# DNSSEC monitoring: alert on validation failures

# Integrate into your existing monitoring:

# - unbound_dnssec_validation_success

# - unbound_dnssec_validation_failure

# DNSSEC key rotation: automate via cron + unbound-anchor

Maintenance and Evolution

Recurring Tasks

📅 Weekly

Check error logs (journalctl -u unbound -p err)

📅 Monthly

Validate DNSSEC trust anchor updates (unbound-anchor -a /var/lib/unbound/root.key)

📅 Quarterly

Review access-control and private-address rules

🔄 On each update

Dry-run test the configuration before deployment

Reminder — Before any restart, always validate the syntax with unbound-checkconf /etc/unbound/unbound.conf then reload with systemctl reload unbound.

Verified Sources

This guide relies exclusively on primary and verifiable sources:

🔗 Official Unbound Documentation

NLnet Labs official documentation, manpages unbound.conf(5), and architecture release notes.

📢 NLnet Labs — Unbound 1.25.1

Official release announcement May 20, 2026 and security vulnerability fixes for 11 CVEs.

🛡️ NIST SP 800-81r3 (2026)

Secure Domain Name System Deployment Guide: strategic baseline for enterprise DNS resilience.

📜 IETF Standards: RFC 8484 & RFC 9250

Official IETF standards defining DNS over HTTPS (DoH) and DNS over QUIC (DoQ) protocols.

🦎 openSUSE Wiki — Unbound Guide

openSUSE Tumbleweed system integration guidelines, package details, and service hardening.

🔍 CVE Vulnerability Tracking

CIRCL, NVD, and Ubuntu security tracker bulletins and vulnerability metrics for Unbound.

🌐 Public Upstream Resolvers

Official technical documentation for encrypted upstream DoT, DoH, and DoQ services (Quad9, Cloudflare, Google).

Editorial compliance: Factual statements are sourced; recommendations are contextualized by scenario; critical warnings are visually flagged.

Table of Contents

DNS Security with Unbound in 2026 (Updated May 2026)

Introduction — Unbound in 2026: State of Play

Essential Configuration for Unbound ≥1.25.1

Modern Encryption: DoT / DoH / DoQ

System Hardening: openSUSE Tumbleweed

Deployment Scenarios: Tailoring the Configuration

Maintenance and Evolution

Recurring Tasks

Verified Sources

Recommended SafeITExperts Readings

About the Author

👥 Comments