Lion Cipher Lab
Set up your own DNS resolver with Unbound
- Cyber / Security Engineer
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Every site you visit begins with a DNS lookup, and normally you hand that lookup — a running list of everywhere you go — to someone else's resolver: your ISP's, or a public one you picked. Running your own recursive, validating resolver with Unbound changes that: your machine asks the authoritative servers directly, so you are no longer funnelling every question through one company that can log or profile it, and you get to enforce DNSSEC validation yourself so forged answers are caught rather than trusted. It is a foundational piece of controlling your own network, and the exact skill behind…
What you'll learn
- what a recursive DNS resolver is
- installing and configuring Unbound
- writing a minimal hardened unbound.conf
- DNSSEC validation
- qname minimisation and resolver hardening
- avoiding an open resolver
- testing resolution and reading a query log
Steps in this lab
- What a recursive resolver is, and what Unbound is
- Why run your own — and the responsibility that comes with it
- Install Unbound
- Write a minimal, hardened unbound.conf
- Set up DNSSEC validation (the trust anchor)
- Understand the privacy hardening you just turned on
- Start it, point a client at it, and prove it works
- Read the query log, and take the responsibility seriously