Skip to content

Unbound DNS Resolver

Unbound DNS Resolver runs Unbound 1.26.1 on Ubuntu 24.04 as a validating, recursive, caching DNS resolver. It answers on loopback only and refuses every other client until you open it up. A small signed test zone, created on first boot, lets you see DNSSEC validation work straight away.

Launch on AWS Marketplace Getting started

What is pre-installed

  • Unbound 1.26.1, built from the official NLnet Labs source tarball, with unbound, unbound-checkconf, unbound-control and unbound-anchor in /usr/sbin. DNS over HTTPS and DNS over QUIC are not built in.
  • systemd units: unbound.service is the resolver, unbound-auth.service serves the local test zones, and sushi-unbound-firstboot.service prepares the instance on first boot. Both Unbound services run as the unbound system user.
  • dig and the BIND signing tools from Ubuntu, for testing and for signing the test zone. The BIND name server is not installed.
  • A walkthrough script at /opt/sushi/docs/demo.sh.

Nothing secret is baked into the image. The root trust anchor, the test zone's DNSSEC keys and the configuration are created on your instance on first boot.

Ports

Address What it is
127.0.0.1:53, UDP and TCP The recursive resolver. Only 127.0.0.1 may query it.
127.0.0.1:5353, UDP and TCP Local authoritative server for the test zones. Not for clients.

There is no inbound service port, and you do not need any inbound security group rule.

Test names

Name Answer
app.pilot.invalid 192.0.2.10, from local data
app.secure.test 192.0.2.20, DNSSEC-validated
missing.secure.test A validated NXDOMAIN
app.broken.test SERVFAIL, because its trust anchor matches no key

All test addresses are documentation addresses, not real hosts.

How billing works

The software is billed by the hour while an instance is running, on the t3.medium instance type. AWS bills EC2, EBS and data transfer separately. The current price and any free trial are shown on the AWS Marketplace listing and in the offer terms.

Where to go next

Upstream project

Unbound is published by NLnet Labs under a BSD license. Software Sushi packages it independently and does not claim upstream endorsement. The exact source used for this build is on the instance at /usr/share/doc/unbound/unbound-1.26.1.tar.gz. For the full configuration reference, see the Unbound documentation.