# Anyone using Knot-resolver?

**URL:** <https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750>\
**Category:** Customizing Pi-hole\
**Created:** [May 8, 2019, 12:24pm UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750 "2019-05-08T12:24:23Z")\
**Posts on this page:** 20\
**Page:** 4

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [May 13, 2019, 7:21pm UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/65 "2019-05-13T19:21:15Z")

</div>

> [@jpgpi250](#):
>
> to store a copy of the root zone locally

Well, in this case extend my example to something that is not the root zone, e.g., `google.com` with its many subdomains.

> [@jpgpi250](#):
>
> Any idea why Simon choose these aggressive values?

No.

> [@ajp2k17](#):
>
> Should that be removed?

Probably, we will discuss this internally.

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [May 14, 2019, 7:27am UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/66 "2019-05-14T07:27:44Z")

</div>

> [@DL6ER](#):
>
> Probably, we will discuss this internally.

When compiling unbound from source, unbound comes with a unbound.conf, listing (all?) possible settings.

Partial content of this file:

```auto
	# the time to live (TTL) value lower bound, in seconds. Default 0.
	# If more than an hour could easily give trouble due to stale data.
	# cache-min-ttl: 0

	# the time to live (TTL) value cap for RRsets and messages in the
	# cache. Items are not cached for longer. In seconds.
	# cache-max-ttl: 86400

	# the time to live (TTL) value cap for negative responses in the cache
	# cache-max-negative-ttl: 3600

```

---

<div class="post-metadata">

**Author:** ![ajp2k17](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/ac91a4/32.png) [@ajp2k17](https://discourse.pi-hole.net/u/ajp2k17)\
**Post date:** [May 14, 2019, 9:08am UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/67 "2019-05-14T09:08:33Z")

</div>

> [@DL6ER](#):
>
> Probably, we will discuss this internally.

I always used to run Knot without min/max TTL becuase I think it handles that on its own by caching popular domains. The manual says:

> Get or set minimum cache TTL. Any entry inserted into cache with TTL lower than minimal will be overridden to minimum TTL. Forcing TTL higher than specified violates DNS standards, use with care.

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [May 17, 2019, 5:26pm UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/68 "2019-05-17T17:26:03Z")

</div>

> [@jpgpi250](#):
>
> When compiling unbound from source, unbound comes with a unbound.conf, listing (all?) possible settings.

Yes, this information is also contained in the `unbound.conf` man page.

Everyone of the team agreed to remove the lines, however, I'm traveling and it will take some time until I can do it.

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [May 17, 2019, 5:41pm UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/69 "2019-05-17T17:41:54Z")

</div>

After running both unbound and knot-resolver for a week now, both with cache settings:

unbound: cache-min-ttl: 3600 - cache-max-ttl: 86400  
knot-resolver: cache.min\_ttl(3600) - cache.max\_ttl(86400)

knot-resolver appears to be the preferred (fastest response) resolver by pihole-FTL.

 ![image](https://discourse.pi-hole.net/uploads/default/original/2X/9/97edae1c2611e538a1512ea4425a6ca94010c0b0.png)  
knot-resolver-IPv4 25%  
knot-resolver-IPv6 20.5%  
unbound-IPv4 6.5%  
unbound IPv6 10.7%

---

<div class="post-metadata">

**Author:** ![ajp2k17](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/ac91a4/32.png) [@ajp2k17](https://discourse.pi-hole.net/u/ajp2k17)\
**Post date:** [May 18, 2019, 7:27am UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/70 "2019-05-18T07:27:38Z")

</div>

I'm experiencing the exact opposite which is weird, I really expected Knot to be faster. Not sure why, maybe something is wrong with my setup. Could you please post your Knot-config again?

 ![image](https://discourse.pi-hole.net/uploads/default/original/2X/4/44ee79c3def4ea0cf75f7a41f24dd2f1a86151da.png)

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [May 18, 2019, 7:46am UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/71 "2019-05-18T07:46:36Z")

</div>

> [@ajp2k17](#):
>
> Could you please post your Knot-config again?

The only thing I added to [this version](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/45) are the cache-ttl (knot-resolver: cache.min\_ttl(3600) - cache.max\_ttl(86400)) settings you suggested.

---

<div class="post-metadata">

**Author:** ![ajp2k17](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/ac91a4/32.png) [@ajp2k17](https://discourse.pi-hole.net/u/ajp2k17)\
**Post date:** [May 18, 2019, 7:49am UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/72 "2019-05-18T07:49:59Z")

</div>

> [@jpgpi250](#):
>
> The only thing I added to [this version](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/45) are the cache-ttl (knot-resolver: cache.min\_ttl(3600) - cache.max\_ttl(86400)) settings you suggested.

Ah ok, thanks! I removed my cache-settings from both Unbound and Knot... interesting. I think Knot needs a bit of time to predict the popular domains though...hmmm.

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [May 18, 2019, 8:05am UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/73 "2019-05-18T08:05:25Z")

</div>

> [@ajp2k17](#):
>
> I removed my cache-settings from both Unbound and Knot

I added the cache settings to knot resolver because:

- you were right to add them to knot-resolver, I forgot they also are a part of the unbound configuration.
- I never had any problems with these cache settings in unbound.
- I think you can only get in trouble with these cache settings if you visit a site, using a DNS name that depends on dynamic DNS. Apparently, since I have no problems, that's NOT an issue for me.

---

<div class="post-metadata">

**Author:** ![ajp2k17](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/a/ac91a4/32.png) [@ajp2k17](https://discourse.pi-hole.net/u/ajp2k17)\
**Post date:** [May 18, 2019, 8:06am UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/74 "2019-05-18T08:06:54Z")

</div>

> [@jpgpi250](#):
>
> - you were right to add them to knot-resolver, I forgot they also are a part of the unbound configuration.
> - I never had any problems with these cache settings in unbound.
> - I think you can only get in trouble with these cache settings if you visit a site, using a DNS name that depends on dynamic DNS. Apparently, since I have no problems, that’s NOT an issue for me.

Thanks, I'll have to do some more testing. 🙂

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [May 18, 2019, 11:38am UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/75 "2019-05-18T11:38:23Z")

</div>

> [@DL6ER](#):
>
> Everyone of the team agreed to remove the lines, however, I’m traveling and it will take some time until I can do it.

> <https://github.com/pi-hole/docs/pull/132>
>
> See title. This has been discussed internally and was triggered by my Discourse …post \[here\](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/65?u=dl6er).

---

<div class="post-metadata">

**Author:** ![Gizmo\_Ger](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/gizmo_ger/32/8032_2.png) [@Gizmo\_Ger](https://discourse.pi-hole.net/u/Gizmo_Ger)\
**Post date:** [May 19, 2019, 5:35pm UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/76 "2019-05-19T17:35:11Z")

</div>

Just a simple question from a rookie: Is there a guide available how to set up PiHole with unbound AND Knot-resolver? Currently I´m running PiHole on an ARMbian/Rock64 platform and it works like a charm. I like the idea of having a backup solution for unbound but my skills are limited how to set up Pihole using both; unbound and knot-resolver. All these different aspects getting me confused: unbound, knot-resolver, cloudflared, stubby, etc...  
If someone feels like pointing me to the right direction please don´t hesistate. Thanks in advance.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [May 19, 2019, 6:07pm UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/77 "2019-05-19T18:07:16Z")

</div>

Use the Pi-Hole unbound guide, and then use whatever knot resolver guides exist on the internet and put knot on a port other than 53 or 5353, and you are set.

> [@Gizmo\_Ger](#):
>
> All these different aspects getting me confused: unbound, knot-resolver, cloudflared, stubby, etc…

Cloudflared and Stubby are different methods of encrypting DNS traffic to an upstream server. Unbound and knot are usually run in recursive mode, doing the same thing as the upstream servers (i.e. directly querying the authoritative name servers).

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [May 19, 2019, 6:22pm UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/78 "2019-05-19T18:22:31Z")

</div>

@Gizmo_Ger  
Just setup unbound, preferably the [compiled version](https://discourse.pi-hole.net/t/compiling-unbound-from-source-getting-unbound-to-work-with-dns-over-tls/19017/2) (the instructions don't work if you already installed unbound using apt-get)  
Configure unbound to use a unique IP and port, for example IP 127.10.10.1 port 5551.  
Look at the configuration example listed earlier in this topic.  
After completing the configuration, restart unbound and check if the resolver responds correctly by entering:

```auto
dig @127.10.10.1 -p 5551 +dnssec www.raspberrypi.org

```

Now install knot-resolver, using the instructions [here](https://software.opensuse.org//download.html?project=home%3ACZ-NIC%3Aknot-resolver-latest&package=knot-resolver). Select your platform and follow the instructions under `Add repository and install manually`  
Configure knot-resolver to use a unique IP and port, for example IP 127.10.10.2 port 5552.  
Again, look at the configuration example listed earlier in this topic.  
After completing the configuration, restart knot-resolver and check if the resolver responds by entering:

```auto
dig @127.10.10.2 -p 5552 +dnssec www.raspberrypi.org

```

Edit /etc/dnsmasq.d/01-pihole.conf and remove all `server=` entries.  
Create a new file /etc/dnsmasq.d/04-servers.conf, content (as per provided examples):

```auto
server=127.10.10.1#5551
server=127.10.10.2#5552

```

restart pihole-FTL.

done...

The changes made to /etc/dnsmasq.d/01-pihole.conf will be undone by `pihole -up` and `pihole -r`, so ensure the server entries are removed from this file after upgrading or reconfiguring.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [May 19, 2019, 6:29pm UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/79 "2019-05-19T18:29:46Z")

</div>

> [@Gizmo\_Ger](#):
>
> I like the idea of having a backup solution for unbound

I run four instances of unbound on four separate Pi/Pi-Hole installs and have not had a problem with unbound on any of them. As a result, I have not found that a backup is necessary.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [May 19, 2019, 6:37pm UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/81 "2019-05-19T18:37:51Z")

</div>

But as a previous commenter noted, unbound was faster for them. So, mileage may vary, But either way, in my opinion no backup is required as either is a reliable DNS server.

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [May 19, 2019, 6:45pm UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/83 "2019-05-19T18:45:11Z")

</div>

> [@jpgpi250](#):
>
> The changes made to /etc/dnsmasq.d/01-pihole.conf will be undone by `pihole -up` and `pihole -r` , so ensure the server entries are removed from this file after upgrading or reconfiguring.

Well, if you use the settings page instead of editing the files directly, then subsequent calls to `pihole` commands will know what you want and won't reset the settings.

> [@jfb](#):
>
> I have not found that a backup is necessary.

I concur. Thanks for pointing this out. Everyone is free to set this up if they feel they need it, but it should be made clear that it is typically _not_ needed. Work that can be avoided, one might say.

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [May 19, 2019, 7:08pm UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/85 "2019-05-19T19:08:42Z")

</div>

Don't stop with just Knot and Unbound, try BIND, PowerDNS and the others as well.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [May 19, 2019, 7:09pm UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/86 "2019-05-19T19:09:42Z")

</div>

> [@jpgpi250](#):
>
> A **single point of failure** ( **SPOF** ) is a part of a system that, if it fails, will stop the entire system from working.

Like the Pi that Pi-Hole may be running on? Or the Pi-Hole software itself? Or the SD card? If any of those fail, the Pi-Hole is out of business as well.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [May 19, 2019, 8:57pm UTC](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750/88 "2019-05-19T20:57:32Z")

</div>

> [@jpgpi250](#):
>
> they might be under attack, ref. the [DNS SURICATA alerts](https://github.com/OISF/suricata/blob/master/rules/dns-events.rules).

I'll take my chances.

[Previous page](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750.md?page=3)

[Next page](https://discourse.pi-hole.net/t/anyone-using-knot-resolver/19750.md?page=5)