Set Up Pi-hole with Unbound as a Self-Hosted DNS Resolver

Taking DNS Into Your Own Hands

Every time you visit a website, your device quietly asks a DNS server to translate that domain name into an IP address. By default, that request goes to whatever server your ISP or router points to – usually a third-party resolver run by Google, Cloudflare, or your internet provider itself. Those resolvers log queries, build profiles, and sometimes serve filtered results. Pi-hole combined with Unbound gives you a way out: a network-wide ad blocker that also handles DNS resolution locally, without forwarding your queries to anyone.

The setup involves two pieces of software working in tandem. Pi-hole acts as a DNS sinkhole, intercepting requests for known ad, tracker, and malware domains and dropping them before they reach your browser. Unbound sits behind it as a recursive resolver, going directly to the authoritative name servers for each domain instead of relying on an upstream forwarder. The result is faster responses for cached queries, no third-party visibility into your browsing habits, and a single dashboard where you can watch your network’s DNS traffic in real time.

What You Need Before You Start

This guide assumes you have a Raspberry Pi running Raspberry Pi OS Lite, though any Debian-based Linux system works – including an LXC container, a VM, or a spare x86 machine running Ubuntu. The device should have a static local IP address assigned either through your router’s DHCP reservation settings or configured directly on the machine. Without a static IP, your router won’t know where to send DNS requests after a reboot.

You will also need SSH access to the machine and a basic familiarity with the terminal. No advanced networking knowledge is required, but you should be comfortable running commands and editing configuration files. If you are planning to extend your home network beyond a single location, this pairs well with a VPN setup – for example, configuring Tailscale exit nodes to route remote traffic back through your Pi-hole when you are away from home.

Installing Pi-hole

Start by updating your system packages. Run sudo apt update && sudo apt upgrade -y to make sure everything is current before adding new software. Once that finishes, install Pi-hole using its one-line installer: curl -sSL https://install.pi-hole.net | bash. The installer launches an interactive setup wizard that walks you through selecting a network interface, choosing an upstream DNS provider (pick anything for now – you will replace it with Unbound shortly), and confirming your static IP.

When the installation completes, Pi-hole prints a web interface URL and a randomly generated admin password. Write that password down or change it immediately with pihole -a -p yournewpassword. The admin interface lives at http://[your-pi-ip]/admin and gives you access to query logs, blocklist management, and system stats. You do not need the interface to run Pi-hole, but it makes managing blocklists significantly easier.

At this stage, Pi-hole is functional but still forwarding DNS queries to a third-party upstream resolver. You can test it by pointing a single device’s DNS settings to your Pi’s IP address and browsing normally. Ads on most websites should disappear immediately. The default blocklists that ship with Pi-hole cover the most common ad and tracking domains, and you can add community-maintained lists from the Firebog repository through the interface under Group Management – Adlists.

One thing to adjust before moving on: open /etc/pihole/pihole-FTL.conf and add BLOCKINGMODE=NULL if you want blocked queries to return a null response instead of the default NXDOMAIN. This prevents some apps from falling back to alternate DNS servers when they receive a domain-not-found response. It is a minor setting, but it closes a common loophole used by apps that try to detect DNS-level blocking.

Installing and Configuring Unbound

Install Unbound with sudo apt install unbound -y. Once installed, create a new configuration file specifically for Pi-hole integration: sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf. This keeps your custom settings separate from the default Unbound configuration and makes future updates cleaner.

Paste the following block into that file:

• server:
• verbosity: 0 – keeps logs quiet unless you are debugging
• interface: 127.0.0.1 – binds Unbound to localhost only
• port: 5335 – the port Pi-hole will forward queries to
• do-ip4: yes and do-ip6: no – disable IPv6 if your network does not use it
• do-udp: yes and do-tcp: yes
• do-daemonize: no
• trust-anchor-signaling: yes and root-hints: “/var/lib/unbound/root.hints”
• harden-glue: yes, harden-dnssec-stripped: yes, use-caps-for-id: yes
• edns-buffer-size: 1472
• prefetch: yes – refreshes frequently accessed records before they expire
• num-threads: 1
• so-rcvbuf: 1m
• private-address: 192.168.0.0/16 and other RFC 1918 ranges

Before starting Unbound, download the root hints file, which tells the resolver where to find the DNS root servers: wget -O /var/lib/unbound/root.hints https://www.internic.net/domain/named.root. Schedule this to refresh annually with a cron job, since the root server list changes occasionally. Start Unbound with sudo service unbound start and test it directly with dig pi-hole.net @127.0.0.1 -p 5335. A successful response with a status of NOERROR and a DNSSEC signature confirms everything is working.

Connecting Pi-hole to Unbound

Open the Pi-hole admin interface and navigate to Settings – DNS. Uncheck all existing upstream DNS providers. In the custom DNS field on the left, enter 127.0.0.1#5335. Save the settings. Pi-hole will now forward all queries it does not block to your local Unbound instance instead of sending them to Google or Cloudflare.

Disable the stub zone that some Unbound installations create by default. Check whether /etc/unbound/unbound.conf.d/resolvconf_resolvers.conf exists on your system. If it does, delete it or it will override your custom configuration. Run sudo service unbound restart after removing it. Verify the full chain is working by running dig pi-hole.net from any device on your network that is using the Pi as its DNS server – the response time for the first query will be slightly longer as Unbound walks the DNS tree, but subsequent queries for the same domain will return from cache in under a millisecond.

Pointing Your Network to Pi-hole

The cleanest way to route all devices through Pi-hole is to change the DNS server address in your router’s DHCP settings. Every router interface is different, but the setting is usually found under LAN Setup or DHCP Server. Replace the existing DNS entries with your Pi’s static IP address. Devices will pick up the new setting automatically when their DHCP leases renew, though you can speed this up by disconnecting and reconnecting from Wi-Fi or running ipconfig /renew on Windows devices.

If your router does not allow you to change the DNS settings – some ISP-provided routers lock this down – you can configure individual devices manually. Set the DNS server in your device’s network settings to the Pi’s IP address. This works, but it means any device that does not get manually configured will continue using the ISP’s resolver. A more reliable workaround in locked-router situations is to put the Pi between your router and the rest of the network, though that requires additional hardware.

One scenario worth planning for: Pi-hole going offline. If the Pi crashes or reboots for updates, every device on your network will lose DNS resolution until it comes back up. Adding a secondary DNS entry (pointing to 1.1.1.1 or 8.8.8.8) in your router settings gives devices a fallback, though it means some queries will bypass Pi-hole during an outage. Whether that trade-off is acceptable depends on how much you prioritize uptime versus consistent filtering – and that is the tension that no amount of configuration fully resolves.