# 🧠 How I Added Fallback DNS to My Pi-hole + Unbound Setup (Without Sacrificing Security)

**URL:** <https://discourse.pi-hole.net/t/how-i-added-fallback-dns-to-my-pi-hole-unbound-setup-without-sacrificing-security/79222>\
**Category:** Community How-to's\
**Created:** [April 17, 2025, 5:56pm UTC](https://discourse.pi-hole.net/t/how-i-added-fallback-dns-to-my-pi-hole-unbound-setup-without-sacrificing-security/79222 "2025-04-17T17:56:30Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [April 17, 2025, 8:15pm UTC](https://discourse.pi-hole.net/t/how-i-added-fallback-dns-to-my-pi-hole-unbound-setup-without-sacrificing-security/79222/2 "2025-04-17T20:15:59Z")

</div>

> [@ordor2k](#):
>
> ```auto
> forward-zone:
> name: "."
> forward-first: yes
> forward-addr: 1.1.1.1
> forward-addr: 8.8.8.8
> 
> ```
> 
> (…)
> 
> ### 🔍 How It Works
> 
> - Unbound first tries full DNS recursion (using root servers)
> - If that fails (timeout, broken delegation, etc.), it falls back to `1.1.1.1` or `8.8.8.8`

No, it's the other way round:  
While defining a forward zone will turn off recursion in general, setting `forward-first: yes` instructs _`unbound`_ to resolve DNS requests first by forwarding to `1.1.1.1` or` 8.8.8.8`, and only if that fails, it would fall back to recursive resolution.

Quoting [`unbound.conf` documentation](https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#unbound-conf-forward-forward-first):

> **`forward-first`** : _`<yes or no>`_  
> If a forwarded query is met with a SERVFAIL error, and this option is enabled, Unbound will fall back to normal recursive resolution for this query as if no query forwarding had been specified.  
> Default: no

EDIT:

> [@ordor2k](#):
>
> - `val-permissive-mode: yes` lets it accept results even with DNSSEC issues

Setting `val-permissive-mode: yes` would have _`unbound`_ serve replies that failed DNSSEC validation, i.e. Pi-hole would receive invalid replies.  
It only makes sense to use that if you did configure Pi-hole to do DNSSEC validation:

> [@Understanding DNSSEC validation using Pi-hole's Query Log](https://discourse.pi-hole.net/t/understanding-dnssec-validation-using-pi-holes-query-log/51574/1):
>
> To enable the full validation inside Pi-hole, you have to add
> 
> ```auto
> # Does not actually turn off DNSSEC, but stops the resolver from 
> # withholding bogus answers from clients. 
> val-permissive-mode: yes
> 
> ```
> 
> to the `server` section of your config file. However, be aware that this can void the protection provided by DNSSEC for devices querying `unbound` directly without using your Pi-hole. Hence, we do not recommend enabling permissive mode in production systems.

---

_[View the full topic](https://discourse.pi-hole.net/t/how-i-added-fallback-dns-to-my-pi-hole-unbound-setup-without-sacrificing-security/79222)._