### Example Directory Structure for Custom Unbound Configuration

Source: https://github.com/matthewvance/unbound-docker-rpi/blob/master/README.md

Illustrates a typical directory structure for a fully customized Unbound setup when mounting a volume into the container. This includes the main configuration file and additional zone or other configuration files.

```text
/my-directory/unbound/
-- unbound.conf
-- local-zone-unbound.conf
-- secret-zone.conf
-- some-other.conf
```

--------------------------------

### Deploy Unbound with Wildcard Include Configuration (Bash)

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

This example demonstrates using Unbound's wildcard include feature to manage configuration across multiple files. A main `unbound.conf` enables wildcard includes, and separate files define security settings, performance tuning, local network zones, and upstream forwarders. The deployment includes verification of the combined configuration.

```bash
mkdir -p /my-directory/unbound

cat > /my-directory/unbound/unbound.conf <<'EOF'
server:
    # Basic settings
    interface: 0.0.0.0@53
    directory: "/opt/unbound/etc/unbound"
    chroot: "/opt/unbound/etc/unbound"
    username: "_unbound"

    # Security defaults
    hide-identity: yes
    hide-version: yes

    # Wildcard include for modular configuration
    include: "/opt/unbound/etc/unbound/*.conf"

remote-control:
    control-enable: no
EOF

cat > /my-directory/unbound/01-security.conf <<'EOF'
server:
    harden-glue: yes
    harden-dnssec-stripped: yes
    harden-algo-downgrade: yes
    use-caps-for-id: yes
    val-clean-additional: yes
EOF

cat > /my-directory/unbound/02-performance.conf <<'EOF'
server:
    num-threads: 4
    msg-cache-size: 16m
    rrset-cache-size: 32m
    cache-min-ttl: 300
    cache-max-ttl: 86400
    prefetch: yes
    prefetch-key: yes
EOF

cat > /my-directory/unbound/03-local-network.conf <<'EOF'
server:
    local-zone: "lan." static
    local-data: "gateway.lan. A 192.168.1.1"
    local-data: "pi.lan. A 192.168.1.5"
EOF

cat > /my-directory/unbound/04-forward.conf <<'EOF'
forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 1.1.1.1@853#cloudflare-dns.com
EOF

docker run \
  --name=unbound-rpi \
  --volume=/my-directory/unbound:/opt/unbound/etc/unbound/ \
  --publish=53:53/tcp \
  --publish=53:53/udp \
  --restart=unless-stopped \
  --detach=true \
  mvance/unbound-rpi:latest

docker exec unbound-rpi unbound-checkconf
```

--------------------------------

### Deploy Unbound with Fully Custom Configuration (Bash)

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

This example shows how to deploy an Unbound Docker container using a completely custom `unbound.conf` file. It includes detailed server settings for networking, performance, security, privacy, local zones, and logging, along with forwarder configuration. The snippet also demonstrates how to verify the configuration using `unbound-checkconf`.

```bash
mkdir -p /my-directory/unbound

cat > /my-directory/unbound/unbound.conf <<'EOF'
server:
    # Network settings
    interface: 0.0.0.0@53
    access-control: 0.0.0.0/0 allow
    do-ip6: no

    # Performance
    num-threads: 2
    msg-cache-size: 8m
    rrset-cache-size: 16m
    cache-min-ttl: 3600
    cache-max-ttl: 86400

    # Security
    hide-identity: yes
    hide-version: yes
    harden-glue: yes
    harden-dnssec-stripped: yes
    use-caps-for-id: yes

    # Privacy
    qname-minimisation: yes

    # Local zones
    include: /opt/unbound/etc/unbound/local-zones.conf

    # Working directory
    directory: "/opt/unbound/etc/unbound"
    chroot: "/opt/unbound/etc/unbound"
    username: "_unbound"

    # Logging
    verbosity: 1
    log-queries: no

forward-zone:
    name: "."
    forward-addr: 1.1.1.1
    forward-addr: 8.8.8.8
EOF

cat > /my-directory/unbound/local-zones.conf <<'EOF'
local-zone: "internal.example.com." static
local-data: "router.internal.example.com. IN A 10.0.0.1"
local-data: "printer.internal.example.com. IN A 10.0.0.100"
EOF

docker run \
  --name=unbound-rpi \
  --volume=/my-directory/unbound:/opt/unbound/etc/unbound/ 
  --publish=53:53/tcp \
  --publish=53:53/udp \
  --restart=unless-stopped \
  --detach=true \
  mvance/unbound-rpi:latest

docker exec unbound-rpi unbound-checkconf /opt/unbound/etc/unbound/unbound.conf
dig @localhost router.internal.example.com +short
```

--------------------------------

### Unbound Include Directive Example

Source: https://github.com/matthewvance/unbound-docker-rpi/blob/master/README.md

An example of how to use Unbound's include directive within unbound.conf to load configurations from an external file, such as local zone definitions. This is a common method for segmenting and managing custom DNS records.

```unbound
include: /opt/unbound/etc/unbound/local-zone-unbound.conf
```

--------------------------------

### DNS SRV Record Example

Source: https://github.com/matthewvance/unbound-docker-rpi/blob/master/README.md

An example of DNS SRV (Service) records in a standard zone file format. These records are used to specify the location of services, such as etcd servers, with associated priority and weight information.

```dns
# _service._proto.name. | TTL | class | SRV | priority | weight | port | target.
_etcd-server-ssl._tcp.domain.local.  86400 IN    SRV 0        10     2380 etcd-0.domain.local.
_etcd-server-ssl._tcp.domain.local.  86400 IN    SRV 0        10     2380 etcd-1.domain.local.
_etcd-server-ssl._tcp.domain.local.  86400 IN    SRV 0        10     2380 etcd-2.domain.local.
```

--------------------------------

### Configure Local DNS A and PTR Records (Bash)

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

Sets up custom DNS records for local network devices by creating an `a-records.conf` file. This enables both forward (A records) and reverse (PTR records) lookups for specified local hostnames and IP addresses.

```bash
# Create a-records.conf with local device mappings
cat > a-records.conf <<'EOF'
# A Record - Forward DNS lookup
local-data: "laptop.local. A 192.168.1.100"
local-data: "desktop.local. A 192.168.1.101"
local-data: "server.local. A 192.168.1.10"
local-data: "nas.home.local. A 192.168.1.50"

# PTR Record - Reverse DNS lookup
local-data-ptr: "192.168.1.100 laptop.local."
local-data-ptr: "192.168.1.101 desktop.local."
local-data-ptr: "192.168.1.10 server.local."
local-data-ptr: "192.168.1.50 nas.home.local."
EOF

# Deploy container with custom A records
docker run \
  --name=unbound-rpi \
  --volume=$(pwd)/a-records.conf:/opt/unbound/etc/unbound/a-records.conf:ro \
  --publish=53:53/udp \
  --publish=53:53/tcp \
  --restart=unless-stopped \
  --detach=true \
  mvance/unbound-rpi:latest

# Test forward lookup
dig @localhost laptop.local +short
# Expected output: 192.168.1.100

# Test reverse lookup
dig @localhost -x 192.168.1.100 +short
# Expected output: laptop.local.

# Query multiple records
for host in laptop desktop server nas.home; do
  echo -n "$host: "
  dig @localhost ${host}.local +short
done
```

--------------------------------

### Configure Local DNS SRV Records for Service Discovery (Bash)

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

Illustrates how to define SRV (Service) records within Unbound's configuration using a `srv-records.conf` file. This is useful for service discovery in local networks, such as for etcd or Kubernetes.

```bash
# Create srv-records.conf with service discovery entries
cat > srv-records.conf <<'EOF'
# SRV records for etcd cluster
# _service._proto.name. | TTL | class | SRV | priority | weight | port | target.
_etcd-server-ssl._tcp.domain.local. 86400 IN SRV 0 10 2380 etcd-0.domain.local.
_etcd-server-ssl._tcp.domain.local. 86400 IN SRV 0 10 2380 etcd-1.domain.local.
_etcd-server-ssl._tcp.domain.local. 86400 IN SRV 0 10 2380 etcd-2.domain.local.

# SRV records for LDAP
_ldap._tcp.domain.local. 86400 IN SRV 0 10 389 ldap-server.domain.local.

# SRV records for XMPP
_xmpp-client._tcp.domain.local. 86400 IN SRV 5 0 5222 chat.domain.local.
_xmpp-server._tcp.domain.local. 86400 IN SRV 5 0 5269 chat.domain.local.
EOF
```

--------------------------------

### Configure Unbound with SRV and A Records (Bash)

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

This snippet demonstrates how to configure Unbound DNS to serve custom SRV and A records. It involves creating a configuration file for A records and then running an Unbound Docker container, mounting the record files. Querying these records is also shown.

```bash
cat > a-records.conf <<'EOF'
local-data: "etcd-0.domain.local. A 192.168.1.20"
local-data: "etcd-1.domain.local. A 192.168.1.21"
local-data: "etcd-2.domain.local. A 192.168.1.22"
local-data: "ldap-server.domain.local. A 192.168.1.30"
local-data: "chat.domain.local. A 192.168.1.40"
EOF

docker run \
  --name=my-unbound \
  --volume=$(pwd)/srv-records.conf:/opt/unbound/etc/unbound/srv-records.conf:ro \
  --volume=$(pwd)/a-records.conf:/opt/unbound/etc/unbound/a-records.conf:ro \
  --publish=53:53/udp \
  --publish=53:53/tcp \
  --restart=unless-stopped \
  --detach=true \
  mvance/unbound-rpi:latest

dig @localhost _etcd-server-ssl._tcp.domain.local SRV
dig @localhost _ldap._tcp.domain.local SRV +short
dig @localhost _xmpp-client._tcp.domain.local SRV +short
```

--------------------------------

### Append Customizations to Unbound Configuration

Source: https://github.com/matthewvance/unbound-docker-rpi/blob/master/README.md

This command runs an Unbound container, mounting a directory containing custom Unbound configuration files. This allows for more complex configurations by leveraging Unbound's wildcard include feature, while still maintaining default settings. Ports 53 (TCP and UDP) are exposed, and the container is set to restart unless stopped.

```console
docker run --name=unbound-rpi \
--volume=/my-directory/unbound:/opt/unbound/etc/unbound/ \
--publish=53:53/tcp \
--publish=53:53/udp \
--restart=unless-stopped \
--detach=true \
mvance/unbound-rpi:latest
```

--------------------------------

### Test DNS Query Types with Unbound

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

Tests Unbound's ability to resolve different types of DNS queries (A, AAAA, MX) for a given domain. This is useful for verifying Unbound's query handling capabilities and ensuring it can serve various record types correctly.

```bash
docker exec unbound-rpi drill @127.0.0.1 example.com A
docker exec unbound-rpi drill @127.0.0.1 example.com AAAA
docker exec unbound-rpi drill @127.0.0.1 example.com MX
```

--------------------------------

### Run Unbound Docker Container (Standard Usage)

Source: https://github.com/matthewvance/unbound-docker-rpi/blob/master/README.md

This command runs the Unbound Docker container with default configurations. It publishes ports 53 for both UDP and TCP, enables auto-restart, and runs in detached mode.

```console
docker run \
--name=unbound-rpi \
--publish=53:53/udp \
--publish=53:53/tcp \
--restart=unless-stopped \
--detach=true \
mvance/unbound-rpi:latest
```

--------------------------------

### Deploy and Compare Unbound Versions

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

Deploys two different versions of the Unbound RPi Docker image ('latest' and '1.20.0') on separate ports to facilitate side-by-side comparison. It then tests DNS resolution against both versions.

```bash
docker run -d --name=unbound-latest -p 53:53/udp mvance/unbound-rpi:latest
docker run -d --name=unbound-1.20.0 -p 5353:53/udp mvance/unbound-rpi:1.20.0

# Test both versions
dig @localhost example.com +stats
dig @localhost -p 5353 example.com +stats
```

--------------------------------

### Configure Custom DNS Forwarders for Unbound (Bash)

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

Demonstrates how to override the default DNS forwarders in Unbound by creating a custom `forward-records.conf` file. This allows specifying upstream DNS servers, including custom IP addresses and enabling DNS-over-TLS.

```bash
# Create custom forward-records.conf file
cat > forward-records.conf <<'EOF'
forward-zone:
  # Forward all queries (except those in cache and local zone) to
  # upstream recursive servers
  name: "."

  # Custom upstream DNS server (home router)
  forward-addr: 192.168.0.1@53#home.local

  # Quad9 DNS with malware blocking
  forward-addr: 9.9.9.9@853#dns.quad9.net
  forward-addr: 149.112.112.112@853#dns.quad9.net

  # Enable TLS for upstream queries
  forward-tls-upstream: yes
EOF

# Run container with custom forwarder configuration
docker run \
  --name=my-unbound \
  --volume=$(pwd)/forward-records.conf:/opt/unbound/etc/unbound/forward-records.conf:ro \
  --publish=53:53/udp \
  --publish=53:53/tcp \
  --restart=unless-stopped \
  --detach=true \
  mvance/unbound-rpi:latest

# Test resolution
dig @localhost example.com

# Verify forwarding is working
docker logs my-unbound
```

--------------------------------

### Deploy Unbound Docker Container (Bash)

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

Deploys the Unbound DNS server Docker container with default settings and exposes standard DNS ports. It includes commands to pull the image, run the container, verify its status, and test DNS resolution.

```bash
# Pull the latest image
docker pull mvance/unbound-rpi:latest

# Run the container with standard DNS ports exposed
docker run \
  --name=unbound-rpi \
  --publish=53:53/udp \
  --publish=53:53/tcp \
  --restart=unless-stopped \
  --detach=true \
  mvance/unbound-rpi:latest

# Verify container is running and healthy
docker ps | grep unbound-rpi

# Test DNS resolution
dig @localhost cloudflare.com

# Expected output: DNS response with answer section containing IP addresses
# Check logs for startup messages
docker logs unbound-rpi
```

--------------------------------

### Test DNS Resolution and Forwarding

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

Tests DNS resolution from different configuration files. It uses the 'dig' command to query a local Unbound instance for gateway information and Google's DNS. This helps verify that Unbound is correctly configured for local and external DNS lookups.

```bash
# From 03-local-network.conf
dig @localhost gateway.lan +short
# Tests forwarding from 04-forward.conf
dig @localhost google.com +short
```

--------------------------------

### Test DNS Query Performance and Caching

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

Measures the time taken for a DNS query and assesses caching behavior. By comparing query times with and without caching, one can evaluate the performance benefits of the Unbound resolver.

```bash
# Measure query time and caching behavior
time dig @localhost example.com
```

--------------------------------

### Monitor Unbound Container Logs

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

Monitors the Unbound container logs in real-time. This command is essential for debugging and observing the behavior of the Unbound DNS server as it processes queries and handles events.

```bash
docker logs -f unbound-rpi
```

--------------------------------

### Clean Up Test Unbound Containers

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

Stops and removes Docker containers used for testing different Unbound versions. This ensures a clean environment after comparative testing.

```bash
docker stop unbound-latest unbound-1.20.0
docker rm unbound-latest unbound-1.20.0
```

--------------------------------

### Check Unbound Container Health and Diagnostics

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

Provides commands to check the health status, view health check logs, and perform manual health checks for the Unbound Docker container. It also includes commands to inspect Unbound statistics and cache information.

```bash
# Check container health status
docker inspect unbound-rpi --format='{{.State.Health.Status}}'
# Expected output: healthy

# View detailed health check logs
docker inspect unbound-rpi --format='{{range .State.Health.Log}}{{.Output}}{{end}}'

# Manual health check using drill command
docker exec unbound-rpi drill @127.0.0.1 cloudflare.com
# Expected: DNS response with NOERROR status

# Check Unbound statistics
docker exec unbound-rpi unbound-control-setup
docker exec unbound-rpi unbound-control stats

# View cache information
docker exec unbound-rpi unbound-control dump_cache
```

--------------------------------

### Run Unbound Container with SRV Records

Source: https://github.com/matthewvance/unbound-docker-rpi/blob/master/README.md

This command runs an Unbound container, mounting a local SRV record configuration file into the container. It exposes ports 53 (TCP and UDP) for DNS traffic and restarts the container automatically unless stopped.

```console
docker run \
--name my-unbound \
--volume=$(pwd)/srv-records.conf:/opt/unbound/etc/unbound/srv-records.conf:ro \
--publish=53:53/udp \
--publish=53:53/tcp \
--restart=unless-stopped \
--detach=true \
mvance/unbound-rpi:latest
```

--------------------------------

### Serve Custom DNS Records in Unbound Docker

Source: https://github.com/matthewvance/unbound-docker-rpi/blob/master/README.md

This command configures Unbound to resolve custom DNS records for a local network. It mounts an `a-records.conf` file containing custom A and PTR records into the container. This enables local hostname resolution.

```console
docker run \
--name=unbound-rpi \
--volume=$(pwd)/a-records.conf:/opt/unbound/etc/unbound/a-records.conf:ro \
--publish=53:53/udp \
--publish=53:53/tcp \
--restart=unless-stopped \
--detach=true \
mvance/unbound-rpi:latest
```

--------------------------------

### Test Unbound on Alternate Port

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

Tests DNS resolution against an Unbound instance running on a non-standard port (5353). This is useful when running multiple DNS resolvers or testing specific configurations.

```bash
dig @localhost -p 5353 example.com
```

--------------------------------

### Deploy Specific Unbound Docker Image Version

Source: https://context7.com/matthewvance/unbound-docker-rpi/llms.txt

Deploys a specific version of the Unbound RPi Docker image (1.21.1) and exposes its DNS service on port 5353. This allows for testing compatibility or running multiple versions simultaneously.

```bash
# Deploy version 1.21.1
docker pull mvance/unbound-rpi:1.21.1
docker run \
  --name=unbound-1.21.1 \
  --publish=5353:53/udp \
  --publish=5353:53/tcp \
  --restart=unless-stopped \
  --detach=true \
  mvance/unbound-rpi:1.21.1
```

--------------------------------

### Override Default Forwarders in Unbound Docker

Source: https://github.com/matthewvance/unbound-docker-rpi/blob/master/README.md

This command demonstrates how to override the default forward DNS servers. It mounts a custom `forward-records.conf` file into the container, allowing you to specify different upstream DNS servers. This is useful for privacy or performance.

```console
docker run \
--name=my-unbound \
--volume=$(pwd)/forward-records.conf:/opt/unbound/etc/unbound/forward-records.conf:ro \
--publish=53:53/udp \
--publish=53:53/tcp \
--restart=unless-stopped \
--detach=true \
mvance/unbound-rpi:latest
```

--------------------------------

### Pull Unbound Docker Image

Source: https://github.com/matthewvance/unbound-docker-rpi/blob/master/README.md

This command pulls the latest version of the Unbound Docker image from Docker Hub. It's the first step to run the Unbound DNS server within a Docker container.

```console
docker pull mvance/unbound-rpi:latest
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.