private dns for your whole house with unbound

why your router's default dns is kind of a privacy disaster

every single device in your house, phone, laptop, smart tv, that weird wifi toaster, is shouting dns queries in plaintext to whatever resolver your isp handed you. that's every domain you visit, logged, readable by anyone sniffing the network, and sold or retained depending on your isp's mood. running your own resolver on a raspberry pi fixes this for the whole house at once, with zero software installed on any client device. this is a defensive privacy project, not a "hide from the law" project, it's about shrinking the amount of your browsing habits that leak to third parties by default.

step 1: install unbound

apt install unbound

unbound is a lightweight, validating dns resolver. "validating" means it can do dnssec checks to confirm the answers it gets back haven't been tampered with. it's small enough to run comfortably on a pi, and it doesn't need a gui or a web dashboard to be useful, which also means a smaller attack surface than some of the fancier alternatives.

step 2: encrypt the upstream with dns over tls

forward-tls-upstream: yes

by default, even if unbound is resolving for your household, it might still forward queries upstream to a public resolver in plaintext. this line tells unbound "wrap that outgoing query in tls before it leaves the pi." so instead of your isp or anyone on the path seeing "laptop asked for sketchy-but-legal-forum.com," they just see encrypted traffic to a resolver like cloudflare or quad9. you'd pair this with a forward-addr pointing at a dns-over-tls capable resolver's ip and port 853. the point isn't "trust nobody," it's "stop leaking plaintext to the weakest link in the chain," which for most home networks is the isp's dns logging.

step 3: local names for local devices

local-data: "nas.home. A 192.168.1.50"

this is the part people forget but end up loving. once unbound is your resolver, you can define local-data entries so typing nas.home or printer.home actually resolves to the right device on your lan. no more memorizing ip addresses, no more random cloud-based "smart home" dns tricks. it's a small thing but it makes your homelab feel like an actual network instead of a pile of ip addresses you half remember.

step 4: check your config before it goes live

unbound-checkconf

this validates your config file syntax before you restart the service and potentially break dns for your entire house, which is a very fast way to get a phone call from whoever else lives with you. run this every time you edit the config. it catches typos, missing colons, and bad indentation before they turn into "why doesn't the internet work" at 11pm.

step 5: point your router's dhcp at the pi

once unbound is confirmed running, go into your router's dhcp settings and set the primary dns server to your pi's static local ip. now every device that joins your network automatically gets handed your encrypted, validating resolver, no manual setup on phones, laptops, or that one guest's android tablet. this is the actual "whole house" part, you're changing dns at the source instead of configuring it device by device.

defending this setup itself

a dns resolver sitting on your lan is a juicy target if someone ever gets onto your network, since it sees every query from every device. lock it down: bind unbound to your lan interface only, never expose port 53 to the internet, keep the pi's os patched, and use a non-default, non-guessable password or key-based ssh access on the pi itself. if you want logging for troubleshooting, keep logs local and rotate them, don't ship them to a third party cloud service, that defeats half the point of this exercise.

the takeaway

self hosting dns isn't about being paranoid, it's about removing one more place your daily habits get collected without your say so. unbound on a pi gives you encrypted upstream queries, local name resolution, and a config you fully control, all for the cost of a cheap board and twenty minutes. check your config, lock down access, point your router at it, and you've just made every device on your network a little harder to passively profile.