# I have and use my own upstream DNS server

**URL:** <https://discourse.pi-hole.net/t/i-have-and-use-my-own-upstream-dns-server/8633>\
**Category:** General\
**Created:** [April 6, 2018, 12:37am UTC](https://discourse.pi-hole.net/t/i-have-and-use-my-own-upstream-dns-server/8633 "2018-04-06T00:37:25Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![mibere](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mibere/32/18057_2.png) [@mibere](https://discourse.pi-hole.net/u/mibere)\
**Post date:** [April 6, 2018, 12:37am UTC](https://discourse.pi-hole.net/t/i-have-and-use-my-own-upstream-dns-server/8633/1 "2018-04-06T00:37:25Z")

</div>

It was an interesting evening. After some fiddling I don't use any "external" (Quad9, Cloudflare, ...) upstream DNS server in Pi-hole anymore - Pi-hole uses my own now. Controlled and configured by me, located in my country, IPv4 + IPv6, UDP + TCP, no forwarding (no _forward-zone_), DNSSEC, no logging, no filtering. I like it 😁

[GRC DNS Nameserver Spoofability Test](https://www.grc.com/dns/dns.htm) result

 ![22](https://discourse.pi-hole.net/uploads/default/original/2X/a/a4b5b6a852167bfd3b9133eeb883a40dcf2703f8.png)

---

<div class="post-metadata">

**Author:** ![mibere](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mibere/32/18057_2.png) [@mibere](https://discourse.pi-hole.net/u/mibere)\
**Post date:** [April 6, 2018, 1:51pm UTC](https://discourse.pi-hole.net/t/i-have-and-use-my-own-upstream-dns-server/8633/2 "2018-04-06T13:51:52Z")

</div>

To test your used or own server, here are some sites (and the results of my server):

[http://dnssec.vs.uni-due.de/](http://dnssec.vs.uni-due.de/)

 ![1](https://discourse.pi-hole.net/uploads/default/original/2X/f/f9c3e6ee2971a7a6de58ef90f6f24f6892339193.jpg)

[https://internet.nl/connection/](https://internet.nl/connection/)

 ![2](https://discourse.pi-hole.net/uploads/default/original/2X/9/94d085be8d2b530b451c57e98eb15f055a47cc1f.png)

[https://rootcanary.org/test.html](https://rootcanary.org/test.html)

 ![3](https://discourse.pi-hole.net/uploads/default/original/2X/d/d47b9a3bb099a963add1bdafe7f0180ef2fb84db.jpg)

> **[Check My DNS](https://cmdns.dev.dns-oarc.net/)**

 ![Ohne%20Titel](https://discourse.pi-hole.net/uploads/default/original/2X/7/7e4b2e7e689f3ac2e67c3d0834cc9551494e51bd.jpg)

---

<div class="post-metadata">

**Author:** ![AnxiousIdiot](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/anxiousidiot/32/3240_2.png) [@AnxiousIdiot](https://discourse.pi-hole.net/u/AnxiousIdiot)\
**Post date:** [April 6, 2018, 2:52pm UTC](https://discourse.pi-hole.net/t/i-have-and-use-my-own-upstream-dns-server/8633/3 "2018-04-06T14:52:19Z")

</div>

Nice! Where is it hosted? Are you using Unbound or something else? I tried Unbound on my older RPi 2 and it was pretty fast. Of course, a public DNS server would still be faster, but it wasn't that bad, honestly, still perfectly usable once the cache populates. My ISP DNS is 2-5ms away, so it kinda doesn't make sense for me to run my own DNS at home, but still if you want DNSSEC and more privacy is a fun project to do and you learn something new along the way.

---

<div class="post-metadata">

**Author:** ![mibere](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mibere/32/18057_2.png) [@mibere](https://discourse.pi-hole.net/u/mibere)\
**Post date:** [April 6, 2018, 4:03pm UTC](https://discourse.pi-hole.net/t/i-have-and-use-my-own-upstream-dns-server/8633/4 "2018-04-06T16:03:35Z")

</div>

I'm running Unbound (without forwarding to other DNS servers) on Debian, located in Germany hosted by Hetzner.

It was fun and interesting to set it up.  
It's maybe slower compared to big and distributed server farms like Quad9 or Cloudflare, but as I definitively know that there is no tracking and logging on the own server 😃 ...

---

<div class="post-metadata">

**Author:** ![nero355](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/nero355/32/54774_2.png) [@nero355](https://discourse.pi-hole.net/u/nero355)\
**Post date:** [April 9, 2018, 6:56pm UTC](https://discourse.pi-hole.net/t/i-have-and-use-my-own-upstream-dns-server/8633/5 "2018-04-09T18:56:11Z")

</div>

So tell us more please : How does one start running a private DNS server ?!

I know about the available software like PowerDNS/BIND/etc. but the part that bugs me is where do you get your "source DNS records" from if you understand what I mean ?

I believe two IP's are also mandatory but I am guessing you got those from Hetzner ofcourse 🙂

---

<div class="post-metadata">

**Author:** ![MaDa](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/m/9f8e36/32.png) [@MaDa](https://discourse.pi-hole.net/u/MaDa)\
**Post date:** [April 9, 2018, 7:32pm UTC](https://discourse.pi-hole.net/t/i-have-and-use-my-own-upstream-dns-server/8633/6 "2018-04-09T19:32:21Z")

</div>

its easy: install unbound on Debian server (local or service provider)

- [Unbound DNS Server Tutorial @ Calomel.org](https://calomel.org/unbound_dns.html)
- [https://freedif.org/unbound-your-own-dns-server](https://freedif.org/unbound-your-own-dns-server)
- [http://info.menandmice.com/blog/bid/40298/End-to-End-DNSSEC-using-Unbound-DNS](http://info.menandmice.com/blog/bid/40298/End-to-End-DNSSEC-using-Unbound-DNS)
- [https://wiki.archlinux.org/index.php/unbound](https://wiki.archlinux.org/index.php/unbound)
- [https://www.ukuug.org/events/spring2011/timetable/dnssec-unbound.pdf](https://www.ukuug.org/events/spring2011/timetable/dnssec-unbound.pdf)

You can implement unbound without any DNS-Forwarder using `qname-minimisation: yes`

At the first DNS-Stage you can also block DNS-requests using `[dns_blocker.sh](https://github.com/sfeakes/ipfire-scripts)`

unbound could answer with the faster status code NXDOMAIN

a final script setup could be:  
`/bin/dns_blocklist.sh -s 1,2,3,12,13,14 -b /etc/unbound_control/blacklist.hosts && sed -i 's/local-data/local-zone/g; s/[[:space:]]A 127.0.0.1"/" static/g' /etc/unbound/local.d/blocklist.conf && /etc/init.d/unbound restart`

---

<div class="post-metadata">

**Author:** ![DanSchaper](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/danschaper/32/91_2.png) [@DanSchaper](https://discourse.pi-hole.net/u/DanSchaper)\
**Post date:** [April 9, 2018, 7:36pm UTC](https://discourse.pi-hole.net/t/i-have-and-use-my-own-upstream-dns-server/8633/7 "2018-04-09T19:36:54Z")

</div>

I personally run a few Unbound upstreams with DNSSEC enabled on a couple of small TinyKVM nodes ($15/yr). I run them off of Alpine for the small size, but Calomel is a great resource to start with. Thanks @MaDa for the additional sources and tips.

---

<div class="post-metadata">

**Author:** ![nero355](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/nero355/32/54774_2.png) [@nero355](https://discourse.pi-hole.net/u/nero355)\
**Post date:** [April 10, 2018, 7:42pm UTC](https://discourse.pi-hole.net/t/i-have-and-use-my-own-upstream-dns-server/8633/8 "2018-04-10T19:42:10Z")

</div>

> [@MaDa](#):
>
> its easy: install unbound on Debian server (local or service provider)
> 
> [Unbound DNS Server Tutorial @ Calomel.org](https://calomel.org/unbound_dns.html)

Sounds good! Read the first tutorial quickly and I see FreeBSD mentioned so looks like I will be building a new VM soon 😃

---

<div class="post-metadata">

**Author:** ![mibere](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mibere/32/18057_2.png) [@mibere](https://discourse.pi-hole.net/u/mibere)\
**Post date:** [April 10, 2018, 7:49pm UTC](https://discourse.pi-hole.net/t/i-have-and-use-my-own-upstream-dns-server/8633/9 "2018-04-10T19:49:33Z")

</div>

I've stopped my server after a hint by an experienced user and some further reading. The general and urgent recommendation is: do not offer an open recursive resolver, do not run Unbound with 'access-control: 0.0.0.0/0 allow' and/or 'access-control: ::0/0 allow'.

---

<div class="post-metadata">

**Author:** ![mibere](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/mibere/32/18057_2.png) [@mibere](https://discourse.pi-hole.net/u/mibere)\
**Post date:** [April 16, 2018, 9:43pm UTC](https://discourse.pi-hole.net/t/i-have-and-use-my-own-upstream-dns-server/8633/10 "2018-04-16T21:43:45Z")

</div>

As it's a cool project, I switched to _DNSCrypt_ and set up a new public server in Germany. It's in the official [resolver list](https://github.com/DNSCrypt/dnscrypt-resolvers/blob/master/v2/public-resolvers.md) now.  
This server is the only one in my Pi-hole for some days, without problems so far.

Website: [dnscrypt.me](http://dnscrypt.me)

---

<div class="post-metadata">

**Author:** ![DL6ER](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/dl6er/32/281_2.png) [@DL6ER](https://discourse.pi-hole.net/u/DL6ER)\
**Post date:** [April 18, 2018, 4:45pm UTC](https://discourse.pi-hole.net/t/i-have-and-use-my-own-upstream-dns-server/8633/11 "2018-04-18T16:45:55Z")

</div>

See also

> [@Add the ability to let Pi-Hole resolve DNS](https://discourse.pi-hole.net/t/add-the-ability-to-let-pi-hole-resolve-dns/2368/):
>
> Short term user of Pi-Hole here, been an avid user of pfSense with SquidGuard for years but this project appeals to me. The Dashboard i.e. is great and so is the logging. To suit all DNS needs the project could be complemented with an DNS resolver, like [Unbound](https://unbound.net). This way no external DNS servers need to be configured, with the added bonus of privacy (the ISP or other DNS service provides will not see your requests) and better reliability since the independence of the ISP for DNS. I've been runni…

if you want to avoid upstream DNS servers.