For example, imagine a web application that connects to three external APIs every time someone visits your site.
If your server handles thousands of requests a day, it also ends up performing those same DNS lookups thousands of times.
That’s unnecessary network traffic and adds a small delay to every request.
A local caching DNS resolver solves this problem by storing recently used DNS records and reusing them until they expire.
On Rocky Linux 10, you can set one up with Unbound in about ten minutes.
Unbound is a lightweight, validating, recursive DNS resolver developed by NLnet Labs.
Unlike BIND or PowerDNS, it isn’t designed to host DNS zones.
Its main job is to resolve DNS queries, cache the results in memory, and return cached answers instantly when the same domain is requested again.
The steps in this guide work the same on Rocky Linux 10, RHEL 10, and AlmaLinux 10.
All three distributions provide the same unbound package through dnf, use the same configuration files, and behave almost identically once the service is installed and running.
For this guide, we’ll use two Rocky Linux 10 systems.
The DNS server will run Unbound, while the client will use it for DNS lookups.
Before installing anything, make sure the DNS server has the correct hostname and a static IP address.
Since clients will always connect to this server for DNS queries, its IP address should remain the same.
If it changes, clients won’t be able to reach the resolver until their DNS settings are updated.
Run the following commands on the DNS server to verify its hostname and IP address:
You should see the server hostname set to resolver.tecmintlocal.com and the network interface assigned the IP address 192.168.1.50.
If your environment uses different values, simply replace the hostnames and IP addresses throughout this guide with your own.
Start by updating your system packages, then install Unbound along with the bind-utils package.
The bind-utils package includes the dig command, which is one of the most useful tools for testing DNS.
We’ll use it later to verify that Unbound is resolving queries correctly and serving cached results.
Before making any changes, it’s also a good idea to back up the default Unbound configuration file.
If you accidentally make a mistake while editing the configuration, you can quickly restore the original file instead of reinstalling the package.
Open the Unbound configuration file in your preferred text editor.
Inside the server: section, add or update the following settings:
Here’s what these settings do:
By default, Unbound can perform full recursive DNS lookups by contacting the root DNS servers.
For many environments, it’s simpler and often faster to forward requests to trusted upstream DNS providers instead.
Add the following section at the end of the configuration file:
In this example:
If the first server is unavailable, Unbound automatically tries the next one.
Before starting Unbound, make sure that no other service is already using port 53, which is the standard port for DNS.
On Rocky Linux, systemd-resolved is enabled by default and often creates a local DNS stub listener on 127.0.0.53:53.
If that port is already in use, Unbound won’t be able to start.
To check which service is using port 53, run:
If you see systemd-resolved listening on port 53, disable only its DNS stub listener.
This frees the port for Unbound while allowing systemd-resolved to continue handling other system functions.
Create a configuration file with the following setting:
After restarting the service, check port 53 again:
If nothing is listening on port 53, Unbound will be able to bind to it when you start the service in the next step.
Before starting the service, check the configuration file for syntax errors, which helps you catch any mistakes before Unbound tries to load the configuration.
If the configuration is valid, the command returns:
If you see any error messages, Unbound will usually tell you the line number where the problem occurred.
Open the configuration file, correct the error, and run the command again until no errors are reported.
Once the configuration passes validation, start the Unbound service and enable it to start automatically whenever the system boots:
Next, verify that the service is running:
If everything is working correctly, you should see the service in the active (running) state.
If the service fails to start, review the status output for error messages.
You can also check the log file you configured earlier or view the system journal for more detailed information:
If firewalld is enabled, you’ll need to allow incoming DNS traffic so that other systems on your network can use the Unbound server.
Run the following commands:
To verify that the rule has been added successfully, run:
If everything is configured correctly, you should see dns listed along with any other services that are already allowed, for example:
At this point, your firewall is configured to accept DNS requests from the clients allowed by your Unbound configuration.
Now it’s time to confirm that Unbound is actually caching DNS responses.
From the DNS server, query a domain using dig and point it directly to your Unbound server:
Look for the Query time field in the output.
The first lookup usually takes longer because Unbound has to contact the upstream DNS servers to resolve the domain.
For example:
Now run the same command again:
This time, the response should be much faster because Unbound can return the answer from its cache instead of performing another external DNS lookup.
For example:
The exact query times will vary depending on your network and upstream DNS servers, but the second lookup should be noticeably faster than the first.
A query time of 0 ms or 1 ms is common when the answer is served from the local cache.
You can also test with a different domain, such as:
Run each command twice and compare the query times.
The first lookup retrieves the DNS record from the upstream resolver, while the second lookup is typically served directly from Unbound’s cache, demonstrating that DNS caching is working as expected.
With the DNS server up and running, the final step is to configure a client machine to use it for DNS lookups.
If you’re using NetworkManager, set your Unbound server (192.168.1.50) as the preferred DNS server for the network connection.
First, list the available network connections:
Note the name of the active connection (for example, “Wired connection 1“), then run:
These commands configure the client to use your Unbound server for DNS resolution instead of the DNS servers provided automatically by your router or DHCP server.
Display the contents of /etc/resolv.conf:
You should see your Unbound server listed, for example:
Now test DNS resolution from the client:
In the output, look for the SERVER field.
It should show your Unbound server:
You can also test with a few additional domains:
If the queries complete successfully and the SERVER field points to 192.168.1.50, your client is now using Unbound as its DNS resolver.
From this point on, repeated DNS lookups for the same domains will be served from Unbound’s cache whenever possible, reducing lookup times and minimizing unnecessary requests to upstream DNS servers.
A handful of unbound-control commands cover most day-to-day maintenance.
If a client reports it can’t resolve anything, check journalctl -u unbound -f first, because most failures trace back to either the access-control list not including the client’s subnet, or the forward zone pointing at an upstream resolver that’s unreachable from your network.
You’ve now set up Unbound as a local caching DNS resolver on Rocky Linux 10.
From this point on, repeated DNS requests for the same domains are served directly from the local cache instead of being sent to upstream DNS servers every time.
This reduces DNS lookup times, lowers unnecessary network traffic, and can improve the responsiveness of applications that frequently access the same external services.
Have you run Unbound in production, or are you still relying on your ISP’s resolver? Tell us what pushed you one way or the other in the comments.
Install GNOME on Rocky Linux 10 Using ISO (Offline)
How to Install Icinga 2 Monitoring Server on Rocky Linux 10
Cockpit on Rocky Linux 10: Full Server Management Without SSH
Install Rocky Linux 10 Remotely via RDP on a Headless Server
Create a Self-Signed SSL Certificate for Apache on Rocky Linux 10
Upgrade Rocky Linux 9 to Rocky Linux 10.1
Thanks for the article.
Feel it very authoritatively.
I don’t know if this is a typesetting problem, but the file log should be in quotes and the directory should have the user unbound.
I.E.
should be more like:
where /var/log/unbound user and group is set to the unbound user like so:
hope this helps someone setting up logging!
Hi,
This is very useful article.
Whenever I’m stuck, this website helps me a lot.
Thanks to you.
Dear Babin Lonston,
Thanks for your guide, but i have a problem .
When i do follow step by step above.
I have a error when check unbound.conf file
[root@localhost unbound]# unbound-checkconf /etc/unbound/unbound.conf
/etc/unbound/unbound_server.key: No such file or directory
[1511340951] unbound-checkconf[9120:0] fatal error: server-key-file: “/etc/unbound/unbound_server.key” does not exist
How can i fix it ? I find out a command like “control-use-cert: no” in some unbound version.
But it is not available for unbound 1.4.20 on Centos7 .
Thanks and wait for your reply 🙂
1.systemctl start unbound.service
2.sudo systemctl enable unbound.service
3.unbound-checkconf /etc/unbound/unbound.conf
Hi,
Very useful article
Thanks a lot
Hi, thank you for the post.
How did you manage to get all that options in the setup command in Red Hat 7? In Centos 7 I only have System Authentication and System Services.
I know nmtui, which is good to configure dns clientes, and firewall-config for firewall.
But it would be nice to try all that options from setup command.
Thanks in advance
RODOLFO
Setup command not available in Centos, RHEL 7 Instead you can use nmcli from command line or use the nmtui.
How to Monitor Linux Server Security with Osquery
20 Netstat Commands for Linux Network Management
CoreFreq – A Powerful CPU Monitoring Tool for Linux Systems
Nethogs – Monitor Linux Network Traffic Usage Per Process
6 Key Performance Metrics to Monitor in Linux Servers – Part 1
Install OpenNMS Network Monitoring in Debian and Ubuntu
A Simple Breakdown of Localhost and 127.0.0.1 in Networking
Zaloha.sh – A Simple Local Directory Synchronizer Script for Linux
How to Increase Disk Inode Number in Linux
Fd – The Best Alternative to ‘Find’ Command for Quick File Searching
How to Recover Deleted Files in Linux Before They’re Gone
Googler: A Command Line Tool to Do ‘Google Search’ from Linux Terminal
23 Best Open Source Text Editors for Linux in 2024
Top 6 Partition Managers (CLI + GUI) for Linux
10 Tools to Take or Capture Desktop Screenshots in Linux
4 Best Tools for Creating Fillable PDF Forms on Linux
7 Best Skype Alternatives for Linux in 2025
Top 7 Free Odoo Apps for Linux Users in 2025
—
**📚 Original Source:**
[Set Up a Local Caching DNS Resolver with Unbound on Rocky Linux 10](https://www.tecmint.com/install-unbound-dns-resolver-rocky-linux/)
About The Author
