### Verify Unbound Installation Version Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/installation.md Tests the Unbound installation by running the unbound command with the -V option to display its version and build information. This confirms that the installation was successful. ```bash unbound -V ``` -------------------------------- ### Install Unbound Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/installation.md Installs the compiled Unbound software onto the system, making it available for use. This step typically requires administrator privileges. ```bash sudo make install ``` -------------------------------- ### Install wget using Homebrew Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/installation.md Installs the wget utility using the Homebrew package manager. Wget is used to download files from the internet, in this case, the Unbound source code. ```bash brew install wget ``` -------------------------------- ### Install Required Libraries using Homebrew Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/installation.md Installs OpenSSL and Expat libraries using Homebrew, which are necessary dependencies for Unbound. Homebrew will output the installation paths, which may be needed for the configure step. ```bash brew install openssl@1.1 brew install expat ``` -------------------------------- ### Install Homebrew and Unbound on macOS Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/installation.md Commands to install the Homebrew package manager and subsequently use it to install Unbound on macOS Big Sur. ```bash /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" brew install unbound ``` -------------------------------- ### Install Xcode Command Line Tools Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/installation.md Installs the essential command-line development tools for macOS, including compilers and build utilities required for compiling software like Unbound. This can be done via a graphical prompt or directly in the terminal. ```bash xcode-select --install ``` -------------------------------- ### Install Unbound via Ubuntu APT Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/installation.md Commands to update the local package index and install the Unbound DNS resolver package on Ubuntu systems. ```bash sudo apt update sudo apt install unbound ``` -------------------------------- ### DNS Zone with Wildcard Record Example Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/topics/privacy/aggressive-nsec.md Illustrates a DNS zone configuration that includes a wildcard record (*.example.net) and other records like SOA, NS, A, and TXT. This serves as the basis for demonstrating wildcard answer generation. ```text example.net. IN SOA [..] IN NS alfa.example.net. *.example.net. IN TXT "A wildcard record" alfa.example.net. IN A 198.51.100.52 sierra.example.net. IN A 198.51.100.98 ``` -------------------------------- ### Verify GCC Compiler Installation Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/installation.md Checks if the GCC compiler, part of the Xcode Command Line Tools, is installed correctly by querying its version. A successful output indicates the compiler is ready for use. ```bash gcc --version ``` -------------------------------- ### Build and Compile Unbound from Source Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/installation.md A comprehensive set of commands to download, configure, and compile Unbound from source on Ubuntu 22.04. This includes installing build dependencies like build-essential, libssl-dev, libexpat1-dev, bison, and flex. ```bash wget https://nlnetlabs.nl/downloads/unbound/unbound-latest.tar.gz tar xzf unbound-latest.tar.gz sudo apt update sudo apt install -y build-essential sudo apt install -y libssl-dev sudo apt install -y libexpat1-dev sudo apt-get install -y bison sudo apt-get install -y flex ./configure make sudo make install ``` -------------------------------- ### Example program invocation and output Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/developer/libunbound-tutorial/resolve-a-name.md Demonstrates the command-line invocation of a compiled C program that resolves a host address using Unbound, and shows the expected output. ```bash $ example_1 The address is 213.154.224.1 ``` -------------------------------- ### Setup Munin Plugin for Unbound Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/topics/core/monitoring.md Commands and configuration snippets to register the Unbound Munin plugin. This enables the collection of various metrics for visualization in Munin. ```bash $ ln -s /etc/unbound/unbound_munin_ /etc/munin/plugins/unbound_munin_hits ``` ```text [unbound*] user root env.statefile /usr/local/var/munin/plugin-state/unbound-state env.unbound_conf /usr/local/etc/unbound/unbound.conf env.unbound_control /usr/local/sbin/unbound-control env.spoof_warn 1000 env.spoof_crit 100000 ``` -------------------------------- ### Configure Unbound Build (Default Paths) Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/installation.md Configures the Unbound build process using the default settings. The configure script checks for necessary libraries and tools, and it will report any missing dependencies. ```bash ./configure ``` -------------------------------- ### Install Homebrew Package Manager on macOS Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/installation.md Installs the Homebrew package manager, a prerequisite for installing other development tools and libraries on macOS. This command downloads and executes the official installation script. ```bash /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" ``` -------------------------------- ### Manage Unbound Service via Homebrew Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/use-cases/local-stub.md Start the Unbound service using Homebrew services. This automatically handles the creation of launchd configuration files to ensure the service persists across system reboots. ```bash sudo brew services start unbound ``` -------------------------------- ### RPZ Zone File with CNAME Override Example Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/topics/filtering/rpz.md An example of an RPZ zone file demonstrating how to use CNAME records for policy actions, intended to be used with the 'rpz-action-override: cname' configuration. ```dns-zone RPZ zone (rpz.nlnetlabs.nl): $ORIGIN rpz.nlnetlabs.nl. drop.example.com.rpz.nlnetlabs.nl. CNAME rpz-drop. 32.34.216.184.93.rpz-ip.rpz.nlnetlabs.nl. A 192.0.2.1 ``` -------------------------------- ### RFC 8767 Configuration Example Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/topics/core/serve-stale.md Basic configuration for enabling RFC 8767 serve-expired behavior in Unbound. ```text server: serve-expired: yes serve-expired-ttl: 86400 # one day, in seconds (default) serve-expired-client-timeout: 1800 # 1.8 seconds, in milliseconds (default since 1.23.0) ``` -------------------------------- ### Download and Extract Unbound Source Code Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/installation.md Downloads the latest stable version of Unbound from its official repository using wget and then extracts the tarball. This prepares the source code for compilation. ```bash wget https://nlnetlabs.nl/downloads/unbound/unbound-latest.tar.gz tar xzf unbound-latest.tar.gz ``` -------------------------------- ### Configure Unbound Build (Manual Paths) Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/installation.md Configures the Unbound build process, manually specifying the paths for OpenSSL and Expat libraries. This is useful when the configure script cannot automatically locate them, especially after using Homebrew. ```bash ./configure --with-ssl=/opt/homebrew/Cellar/openssl@1.1/1.1.1k/ \ --with-libexpat=/opt/homebrew/Cellar/expat/2.3.0 ``` -------------------------------- ### Compile Unbound using Make Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/installation.md Compiles the Unbound source code using the make utility. This process transforms the source code into executable binaries. Compilation may take a significant amount of time. ```bash make ``` -------------------------------- ### Basic Unbound Server Configuration Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/configuration.md This snippet shows a basic, recommended Unbound server configuration. It includes settings for DNSSEC, privacy enhancements (qname-minimisation), network interface binding, and access control for clients. ```bash server: # can be uncommented if you do not need user privilege protection # username: "" # can be uncommented if you do not need file access protection # chroot: "" # location of the trust anchor file that enables DNSSEC. note that # the location of this file can be elsewhere auto-trust-anchor-file: "/usr/local/etc/unbound/root.key" # auto-trust-anchor-file: "/var/lib/unbound/root.key" # send minimal amount of information to upstream servers to enhance privacy qname-minimisation: yes # specify the interface to answer queries from by ip-address. interface: 0.0.0.0 # interface: ::0 # addresses from the IP range that are allowed to connect to the resolver access-control: 192.168.0.0/16 allow # access-control: 2001:DB8::/64 allow ``` -------------------------------- ### DNS Wildcard Answer Generation Example Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/topics/privacy/aggressive-nsec.md Shows the DNS answer section for a query (e.g., delta.example.net TXT) that is resolved using a wildcard record. It includes the wildcard answer and the supporting NSEC record that proves the absence of a direct match. ```dns ;; ANSWER SECTION: delta.example.net. IN TXT "A wildcard record" delta.example.net. IN RRSIG TXT 8 2 [..] ;; AUTHORITY SECTION: alfa.example.net. IN NSEC sierra.example.net. A ``` -------------------------------- ### Configure and Build Unbound Python Features Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/developer/python-modules.md Commands to enable Python bindings or modules during the Unbound installation process and generate the associated documentation using make. ```bash ./configure --with-pyunbound make doc ``` ```bash ./configure --with-pythonmodule make doc ``` -------------------------------- ### Configure Unbound Context with System Files in C Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/developer/libunbound-tutorial/setup-context.md This C program initializes an Unbound context, loads DNS settings from /etc/resolv.conf, and maps local hostnames from /etc/hosts. It performs a DNS A record lookup for a specified domain and outputs the resolved IP address. ```c #include #include #include #include #include int main(void) { struct ub_ctx* ctx; struct ub_result* result; int retval; /* create context */ ctx = ub_ctx_create(); if(!ctx) { printf("error: could not create unbound context\n"); return 1; } /* read /etc/resolv.conf for DNS proxy settings (from DHCP) */ if( (retval=ub_ctx_resolvconf(ctx, "/etc/resolv.conf")) != 0) { printf("error reading resolv.conf: %s. errno says: %s\n", ub_strerror(retval), strerror(errno)); return 1; } /* read /etc/hosts for locally supplied host addresses */ if( (retval=ub_ctx_hosts(ctx, "/etc/hosts")) != 0) { printf("error reading hosts: %s. errno says: %s\n", ub_strerror(retval), strerror(errno)); return 1; } /* query for webserver */ retval = ub_resolve(ctx, "www.nlnetlabs.nl", 1 /* TYPE A (IPv4 address) */, 1 /* CLASS IN (internet) */, &result); if(retval != 0) { printf("resolve error: %s\n", ub_strerror(retval)); return 1; } /* show first result */ if(result->havedata) printf("The address is %s\n", inet_ntoa(*(struct in_addr*)result->data[0])); ub_resolve_free(result); ub_ctx_delete(ctx); return 0; } ``` -------------------------------- ### Configure Unbound Persistence via launchd Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/use-cases/local-stub.md Manually configure Unbound to run at startup by creating a plist file for launchd. This involves defining the service path, configuration file location, and setting appropriate file permissions. ```xml Label nl.nlnetlabs.unbound KeepAlive RunAtLoad ProgramArguments /usr/local/sbin/unbound -c /usr/local/etc/unbound/unbound.conf UserName root StandardErrorPath /dev/null StandardOutPath /dev/null ``` ```bash sudo chmod 644 /Library/LaunchDaemons/nl.nlnetlabs.unbound.plist sudo launchctl load /Library/LaunchDaemons/nl.nlnetlabs.unbound.plist ``` -------------------------------- ### Configure Unbound Logging to Foreground Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/getting-started/installation.md Modifies the Unbound configuration to disable syslog and log directly to the foreground. This is useful for debugging by allowing real-time observation of Unbound's operations and potential errors. ```unbound-config server: use-syslog: no ``` -------------------------------- ### Install Unbound on Ubuntu Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/use-cases/home-resolver.md Installs the Unbound DNS resolver package on Ubuntu 22.04 LTS using the apt package manager. This command updates the package list and then installs Unbound with the '-y' flag to automatically confirm the installation. ```bash sudo apt update sudo apt install unbound -y ``` -------------------------------- ### DNSKEY Record Example Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/developer/libunbound-tutorial/dnssec-validate.md This is an example of a DNSKEY record in zone file format, used for DNSSEC. It specifies the public key used for signing DNS data. Such records can be added to Unbound's trusted keys. ```text nlnetlabs.nl. 3528 IN DNSKEY ( 256 3 5 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAA== ) ``` -------------------------------- ### Adding a Single Trusted Key (Unbound C API) Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/developer/libunbound-tutorial/dnssec-validate.md This example shows how to add a single trusted DNSSEC key to an Unbound context using a string. This function is useful for programmatically adding individual keys when they are not stored in a file. ```c int retval; const char *key_string = "jelte.nlnetlabs.nl. DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD"; if ((retval = ub_ctx_add_ta(ctx, key_string)) != 0) { fprintf(stderr, "Failed to add trusted key: %s\n", strerror(retval)); /* Handle error */ } ``` -------------------------------- ### Stop and Start Unbound Service Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/use-cases/home-resolver.md These commands are used to manage the Unbound service. 'sudo pkill -f unbound' forcefully stops the Unbound process, while 'unbound-control start' restarts the service with the current configuration. 'unbound-control' is also used for reloading and other management tasks. ```bash sudo pkill -f unbound ``` ```bash unbound-control start ``` -------------------------------- ### Resolve host address using Unbound C API Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/developer/libunbound-tutorial/resolve-a-name.md A basic C program that demonstrates how to create an Unbound context, resolve a host address (e.g., 'www.nlnetlabs.nl'), and display the first IPv4 address found. It includes error handling for context creation and resolution. Requires the 'unbound.h' header and standard C libraries. ```c #include /* for printf */ #include /* for inet_ntoa */ #include /* unbound API */ int main(void) { struct ub_ctx* ctx; struct ub_result* result; int retval; /* create context */ ctx = ub_ctx_create(); if(!ctx) { printf("error: could not create unbound context\n"); return 1; } /* query for webserver */ retval = ub_resolve(ctx, "www.nlnetlabs.nl", 1 /* TYPE A (IPv4 address) */, 1 /* CLASS IN (internet) */, &result); if(retval != 0) { printf("resolve error: %s\n", ub_strerror(retval)); return 1; } /* show first result */ if(result->havedata) printf("The address is %s\n", inet_ntoa(*(struct in_addr*)result->data[0])); ub_resolve_free(result); ub_ctx_delete(ctx); return 0; } ``` -------------------------------- ### Unbound Performance Optimization Configuration Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/topics/core/performance.md A sample configuration block for optimizing Unbound performance. Adjust values based on your system's CPU cores and memory. Ensure system-level socket buffer limits are also considered. ```text # some optimisation options. server: # use all CPUs num-threads: # power of 2 close to num-threads # Configure only if you want a specific value here. # If left unconfigured they will be auto-configured wrt num-threads. #msg-cache-slabs: #rrset-cache-slabs: #infra-cache-slabs: #key-cache-slabs: # more cache memory, rrset=msg*2 rrset-cache-size: 100m msg-cache-size: 50m # more outgoing connections # depends on number of cores: 1024/cores - 50 outgoing-range: 950 # Larger socket buffer. OS may need config. so-rcvbuf: 4m so-sndbuf: 4m # Faster UDP with multithreading (only on Linux). so-reuseport: yes ``` -------------------------------- ### Test DNS Resolution Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/use-cases/local-stub.md Verify that the Unbound instance is correctly resolving queries by using the dig utility. This command targets the local loopback address to ensure the service is responding. ```bash dig example.com @127.0.0.1 ``` -------------------------------- ### Compile C program with Unbound library Source: https://github.com/nlnetlabs/unbound-manual/blob/main/source/developer/libunbound-tutorial/resolve-a-name.md Compiles a C program named 'program.c' and links it with the Unbound library. Assumes Unbound is installed in '/usr/local'. Requires the 'gcc' compiler. ```bash gcc -o program program.c -I/usr/local/include -L/usr/local/lib -lunbound ```