# About Unbound

**URL:** <https://discourse.pi-hole.net/t/about-unbound/50839>\
**Category:** General\
**Tags:** unbound\
**Created:** [November 4, 2021, 7:29am UTC](https://discourse.pi-hole.net/t/about-unbound/50839 "2021-11-04T07:29:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![SweeTiPie](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/b38774/32.png) [@SweeTiPie](https://discourse.pi-hole.net/u/SweeTiPie)\
**Post date:** [November 4, 2021, 7:29am UTC](https://discourse.pi-hole.net/t/about-unbound/50839/1 "2021-11-04T07:29:40Z")

</div>

i had follow this guide and install unbound

> **[unbound - Pi-hole documentation](https://docs.pi-hole.net/guides/dns/unbound/)**

from what i had read on the net, this is how unbound work

client \<\> Pi Hole \<\> unbound \<\> Root

i have a few questions and hope this community can help me

1. Is there any command/ways to check if unbound is communicating to root and not cloudflare/ quod9 / google, etc?

2. Unbound send clear text to root, how is it different when we use cloudflare/ quod9 / google DNS ( different as in security )? what happen if there is men-in-the-middle attack?

3. after i had installed unbound, why is pi hole has more forward destination than before i had installed unbound?

ps, i am just a person with zero to limited linux & code knowledge

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [November 4, 2021, 11:03am UTC](https://discourse.pi-hole.net/t/about-unbound/50839/2 "2021-11-04T11:03:01Z")

</div>

> [@SweeTiPie](#):
>
> client \<\> Pi Hole \<\> unbound \<\> Root

Not quite:  
_`unbound`_ enquires with each authoritative DNS server of the domain to be resolved, starting with the root servers. So no one DNS provider has your complete DNS history. In addition, ideally any authoritative DNS server would see only that part of the requested domain it is responsible for resolving.

> [@SweeTiPie](#):
>
> 1. Is there any command/ways to check if unbound is communicating to root and not cloudflare/ quod9 / google, etc?

You could have a look at _`unbound's`_ configuration and its log files, or you could use an online DNS probing tool like [https://www.dnsleaktest.com/](https://www.dnsleaktest.com/), which would show the public IP of your router as being used for DNS queries.

> [@SweeTiPie](#):
>
> 1. Unbound send clear text to root, how is it different when we use cloudflare/ quod9 / google DNS ( different as in security )? what happen if there is men-in-the-middle attack?

In the ways already described above.  
In addition, _`unbound`_ employs a best effort to verify authenticity and integrity of DNS records received by means of DNSSEC. Whether DNSSEC can be employed depends on whether an authoritative DNS server supports it.

> [@SweeTiPie](#):
>
> 1. after i had installed unbound, why is pi hole has more forward destination than before i had installed unbound?

As detailed in the [guide](https://docs.pi-hole.net/guides/dns/unbound/#configure-pi-hole), _`unbound`_ should be your Pi-hole's sole upstream server.  
Please verify that you've correctly applied the settings from the guide.

---

<div class="post-metadata">

**Author:** ![SweeTiPie](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/b38774/32.png) [@SweeTiPie](https://discourse.pi-hole.net/u/SweeTiPie)\
**Post date:** [November 5, 2021, 2:02pm UTC](https://discourse.pi-hole.net/t/about-unbound/50839/3 "2021-11-05T14:02:13Z")

</div>

Hi Bucking\_Horn,

thanks for the explanation, for the last part i believe i wrote it in the wrong way.  
It should be :

Why does pi hole's forward destination percentage increase so much more than before i had installed unbound? Currently it is at 70%

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [November 5, 2021, 3:23pm UTC](https://discourse.pi-hole.net/t/about-unbound/50839/4 "2021-11-05T15:23:39Z")

</div>

> [@SweeTiPie](#):
>
> Why does pi hole's forward destination percentage increase so much more than before i had installed unbound? Currently it is at 70%

The choice of upstream resolver (in this case unbound) is unrelated to the percentage of queries forwarded to the upstream resolver.

If Pi-hole does not answer (including block) the domain locally, and the answer is not in cache, it is forwarded to the upstream resolver.

If you restart Pi-hole, this will clear the cache, as one example.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [November 12, 2021, 3:24pm UTC](https://discourse.pi-hole.net/t/about-unbound/50839/5 "2021-11-12T15:24:22Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.