Unbound - Validating Recursive DNS Resolver

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Unbound is a fast, security-focused, open source validating, recursive and caching DNS resolver from NLnet Labs. Instead of forwarding your DNS to a third-party public resolver, this instance resolves names itself: it walks the DNS hierarchy from the root servers down, cryptographically validates every signed answer with DNSSEC, and caches results so repeat lookups are answered instantly from memory. It is the private resolver you point your own workloads, containers and office networks at, keeping your DNS traffic under your control rather than a third party's. This image delivers Unbound 1.19.2 fully installed, hardened and resolving within minutes of launch, so you skip hours of manual resolver setup and lock-down.

Secure by default, never an open resolver: the shipped configuration restricts recursion to loopback and the RFC1918 private address ranges only. A recursive query from an arbitrary internet source is answered with REFUSED, so this instance can never be abused as a DNS amplification reflector. Opening the resolver to more of your own client subnets is a single documented configuration change, and the user guide walks you through it. This is a self-hosted resolver for your own authorized clients - it is not a public DNS service, an anonymizer or an open resolver.

DNSSEC validation is on out of the box. Unbound seeds the public root trust anchor with unbound-anchor and validates every recursive answer: a signed name is returned with the Authenticated Data (AD) flag set, while a name with a deliberately broken signature (dnssec-failed.org) is rejected with SERVFAIL rather than handed to your clients. The build proves both, plus that a repeat query is served from the in-memory cache.

No default or shared credentials ship in the image. A DNS resolver has no user login; its only management surface is unbound-control, which is configured here on a root-only local UNIX socket with no TLS certificate at all - so there is no control key or password baked into the AMI to leak or rotate. The management channel is never exposed to the network. Systemd-resolved's stub listener is disabled so Unbound owns port 53 cleanly, and the operating system keeps resolving its own names through the VPC upstream resolver.

Key capabilities: high-performance recursive resolution with an in-memory cache and prefetch; full DNSSEC validation of signed zones; QName minimisation for query privacy; aggressive NSEC caching; response and per-IP rate limiting plus identity/version hiding and glue hardening to blunt cache poisoning and reflection; and a small, auditable, single-service footprint with no database to run.

Get started: SSH in as your instance's default login user, confirm the resolver with dig @127.0.0.1 example.com, add your own client subnets to access-control, then point your workloads and networks at this instance for DNS resolution. cloudimg engineers can walk you through client access control, DNSSEC validation, forwarding and performance tuning after purchase.

Unbound is a trademark of NLnet Labs. This image is produced by cloudimg and is not affiliated with, sponsored by or endorsed by NLnet Labs. All other product and company names are trademarks or registered trademarks of their respective holders; use of them does not imply any affiliation or endorsement.