# Pi-Hole + Unbound --\> DNSMASQ & cache enabled or disabled?

**URL:** <https://discourse.pi-hole.net/t/pi-hole-unbound-dnsmasq-cache-enabled-or-disabled/27150>\
**Category:** Customizing Pi-hole\
**Tags:** unbound\
**Created:** [January 20, 2020, 10:50am UTC](https://discourse.pi-hole.net/t/pi-hole-unbound-dnsmasq-cache-enabled-or-disabled/27150 "2020-01-20T10:50:04Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kopernikus](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/k/7feea3/32.png) [@Kopernikus](https://discourse.pi-hole.net/u/Kopernikus)\
**Post date:** [January 20, 2020, 10:50am UTC](https://discourse.pi-hole.net/t/pi-hole-unbound-dnsmasq-cache-enabled-or-disabled/27150/1 "2020-01-20T10:50:04Z")

</div>

Hi,

I'm using Pi-hole with unbouwd as recursive resolver, all working fine.  
However I would like to have advice concerning disabling DNSMASQ & cache in Pihole.  
Some guides say it so others don't...

Can we plz have a statement from the developers?

Thx!

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [January 20, 2020, 10:57am UTC](https://discourse.pi-hole.net/t/pi-hole-unbound-dnsmasq-cache-enabled-or-disabled/27150/2 "2020-01-20T10:57:56Z")

</div>

NOT a developer...  
I'm running pihole-FTL + unbound ([compiled](https://discourse.pi-hole.net/t/compiling-unbound-from-source-getting-unbound-to-work-with-dns-over-tls/19017)) + [redis](https://discourse.pi-hole.net/t/pihole-ftl-unbound-with-cache-db-module-options-redis/24676) with dnsmasq `cache-size=0` for almost a month, NO performance degradation.  
The dsnmasq cache is still used (even with size 0) for all reverse lookup queries.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [January 20, 2020, 1:05pm UTC](https://discourse.pi-hole.net/t/pi-hole-unbound-dnsmasq-cache-enabled-or-disabled/27150/3 "2020-01-20T13:05:29Z")

</div>

The recommendation is to leave the cache alone in Pi-Hole (do not disable it), but disable DNSSEC in Pi -Hole.

Unbound is performing the DNSSEC function and there are some dnsmasq bugs regarding DNSSEC.

Pi-Hole cache enable  
Pihole DNSSEC disable

---

<div class="post-metadata">

**Author:** ![jpgpi250](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jpgpi250/32/286_2.png) [@jpgpi250](https://discourse.pi-hole.net/u/jpgpi250)\
**Post date:** [January 20, 2020, 8:31pm UTC](https://discourse.pi-hole.net/t/pi-hole-unbound-dnsmasq-cache-enabled-or-disabled/27150/4 "2020-01-20T20:31:25Z")

</div>

The discussion, to modify pihole's dnsmasq `cache-size` began when somebody was [investigating the setting](https://discourse.pi-hole.net/t/add-support-for-proxy-dnssec-display-dnssec-info/25936) `proxy-dnssec`. Setting the `cache-size` to `0` solved some, but not all problems with dnssec being handled by unbound.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [January 20, 2020, 8:33pm UTC](https://discourse.pi-hole.net/t/pi-hole-unbound-dnsmasq-cache-enabled-or-disabled/27150/5 "2020-01-20T20:33:43Z")

</div>

The request was for the developers recommendation. That is cache ON, DNSSEC OFF in Pi-Hole.

---

<div class="post-metadata">

**Author:** ![s.beimer](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/s/5daacb/32.png) [@s.beimer](https://discourse.pi-hole.net/u/s.beimer)\
**Post date:** [January 21, 2020, 7:07am UTC](https://discourse.pi-hole.net/t/pi-hole-unbound-dnsmasq-cache-enabled-or-disabled/27150/6 "2020-01-21T07:07:19Z")

</div>

Yes. It turned out that the proxy-dnssec never worked in dnsmasq and probably never will. So ad flag is not cacheable.  
This means:

- If one wants to use proxy-dnssec, that is passing an ad flag from upstream server to the clients, he needs to disable the cache.
- If one wants pi-hole to cache, the proxy-dnssec is not working thus he should use the dnssec validation in pi-hole/dnsmasq.

---

<div class="post-metadata">

**Author:** ![ChurchOfNoise](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/churchofnoise/32/17886_2.png) [@ChurchOfNoise](https://discourse.pi-hole.net/u/ChurchOfNoise)\
**Post date:** [January 18, 2021, 5:19pm UTC](https://discourse.pi-hole.net/t/pi-hole-unbound-dnsmasq-cache-enabled-or-disabled/27150/7 "2021-01-18T17:19:00Z")

</div>

If I understood correctly, DNSSEC setting in Pi-Hole only adds the DNSSEC info in the log?  
Why is it recommended to disable?  
(very willing to disable if there are benefits to it, if not, I'd rather keep the extra info in 1 view within the Pi-Hole interface...)

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [January 18, 2021, 5:31pm UTC](https://discourse.pi-hole.net/t/pi-hole-unbound-dnsmasq-cache-enabled-or-disabled/27150/8 "2021-01-18T17:31:50Z")

</div>

> [@ChurchOfNoise](#):
>
> Why is it recommended to disable?

This was recommended when we were running an older version of dnsmasq that had some DNSSEC bugs. The version currently shipping with Pi-hole is 2.8.2 and does not have this problem. I think the bug was fixed in either 2.8.0 or 2.8.1.

```auto
dig chaos txt version.bind +short @127.0.0.1

"dnsmasq-pi-hole-2.82"

```

You can safely enable DNSSEC if you want to see your DNSSEC status in the query log.