# Setup with Unbound vs Dnscrypt

**URL:** <https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501>\
**Category:** Community Help\
**Created:** [March 17, 2021, 7:00pm UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501 "2021-03-17T19:00:52Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![nullptr](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/c4cdca/32.png) [@nullptr](https://discourse.pi-hole.net/u/nullptr)\
**Post date:** [March 17, 2021, 7:00pm UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/1 "2021-03-17T19:00:53Z")

</div>

I setup PiHole recently, and all's working fine. I went to the website of PiHole and followed the tutorial for Unbound setup, and that's working fine too.

I think my ISP is blocking some of the DNS requests, so I want to setup encrypted DNS requests.

Correct me if I'm wrong, but if I'm using unbound as a recursive DNS resolver, there's no way I can do "encrypted dns", since they "have to be" in plain, as upstream might not support DoH or DoT. So, my solution would be to point PiHole to DoH or DoT server (such as dnscrypt-proxy2) and point that to upstream recursive server, or my own hosted recursive server which runs Unbound, correct?

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [March 18, 2021, 3:00am UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/2 "2021-03-18T03:00:39Z")

</div>

> [@nullptr](#):
>
> I think my ISP is blocking some of the DNS requests,

Why do you think this? What replies do you see that support this assertion?

---

<div class="post-metadata">

**Author:** ![nullptr](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/c4cdca/32.png) [@nullptr](https://discourse.pi-hole.net/u/nullptr)\
**Post date:** [March 18, 2021, 6:07am UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/3 "2021-03-18T06:07:59Z")

</div>

I can visit a few websites through Firefiox with DoH enabled, but not with it disabled

---

<div class="post-metadata">

**Author:** ![nullptr](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/c4cdca/32.png) [@nullptr](https://discourse.pi-hole.net/u/nullptr)\
**Post date:** [March 21, 2021, 10:49am UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/4 "2021-03-21T10:49:16Z")

</div>

What would be the correct approach? Is my reasoning correct?

---

<div class="post-metadata">

**Author:** ![ChurchOfNoise](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/churchofnoise/32/17886_2.png) [@ChurchOfNoise](https://discourse.pi-hole.net/u/ChurchOfNoise)\
**Post date:** [March 21, 2021, 12:56pm UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/5 "2021-03-21T12:56:08Z")

</div>

did you try the command `dig <url here>` from the command line?  
Additionally, did you try `pihole -q <url here>`?

---

<div class="post-metadata">

**Author:** ![nullptr](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/c4cdca/32.png) [@nullptr](https://discourse.pi-hole.net/u/nullptr)\
**Post date:** [March 21, 2021, 2:29pm UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/6 "2021-03-21T14:29:09Z")

</div>

Yeah. I tried some domains without pihole, and pihole + unbound. Both give me the same response. Same if I try to load the website with Firefox. But, if I enable DOH on Firefox, I can reach those domains again.

So,

- pihole + unbound doesn't work
- pihole + dnscrypy (upstream as cloudflare) works
- Normal network without pihole etc doesn't work
- Firefox on normal network + DOH in firefox works

---

<div class="post-metadata">

**Author:** ![nullptr](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/c4cdca/32.png) [@nullptr](https://discourse.pi-hole.net/u/nullptr)\
**Post date:** [March 21, 2021, 2:31pm UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/7 "2021-03-21T14:31:57Z")

</div>

But the main clarification I seek is,

- Unbound can do DOH or DOT with an upstream recursive dns server, or, itself serve as a recursive DNS resolver, but without encryption, correct?

---

<div class="post-metadata">

**Author:** ![ChurchOfNoise](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/churchofnoise/32/17886_2.png) [@ChurchOfNoise](https://discourse.pi-hole.net/u/ChurchOfNoise)\
**Post date:** [March 21, 2021, 3:00pm UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/8 "2021-03-21T15:00:51Z")

</div>

Correct. The authoritative servers don't do DOH or DOT (learned that myself on these forums a while ago 🙂 )

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [March 21, 2021, 3:10pm UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/9 "2021-03-21T15:10:37Z")

</div>

> [@ChurchOfNoise](#):
>
> did you try the command `dig <url here>` from the command line?  
> Additionally, did you try `pihole -q <url here>` ?

Substitute _domain name_ for _ **URL** _.

Pi-hole works with domains, not URLs.

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [March 21, 2021, 3:13pm UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/10 "2021-03-21T15:13:19Z")

</div>

> [@nullptr](#):
>
> Unbound can do DOH or DOT with an upstream recursive dns server,

Depending on your version of unbound. All versions that ship with supported distributions can do DoT, but only newer versions (since 1.12) can do DoH.

> **[Unbound - Download](https://nlnetlabs.nl/projects/unbound/download/#unbound-1-13-1)**

Debian Buster ships with 1.9.0, for example.

---

<div class="post-metadata">

**Author:** ![nullptr](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/c4cdca/32.png) [@nullptr](https://discourse.pi-hole.net/u/nullptr)\
**Post date:** [March 21, 2021, 5:32pm UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/11 "2021-03-21T17:32:31Z")

</div>

> [@jfb](#):
>
> domains, not URLs

My bad, I meant just that!

> [@ChurchOfNoise](#):
>
> Correct. The authoritative servers don't do DOH or DOT

Yeah so I guess unless tech catches up, I'll either have to setup my own recursive DNS resolver somewhere in the cloud, and DoT/DoH to that, or just hand it over to [insert providers]

> [@jfb](#):
>
> Depending on your version of unbound.

Even when setup as a recursive DNS resolver?

---

<div class="post-metadata">

**Author:** ![jfb](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/jfb/32/4332_2.png) [@jfb](https://discourse.pi-hole.net/u/jfb)\
**Post date:** [March 22, 2021, 1:33am UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/14 "2021-03-22T01:33:28Z")

</div>

> [@nullptr](#):
>
> Even when setup as a recursive DNS resolver?

When setup as a recursive resolver, unbound does no encryption. The nameservers don't support it.

---

<div class="post-metadata">

**Author:** ![nullptr](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/c4cdca/32.png) [@nullptr](https://discourse.pi-hole.net/u/nullptr)\
**Post date:** [March 22, 2021, 3:07am UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/15 "2021-03-22T03:07:48Z")

</div>

> [@jfb](#):
>
> When setup as a recursive resolver, unbound does no encryption. The nameservers don't support it.

> [@ChurchOfNoise](#):
>
> Correct. The authoritative servers don't do DOH or DOT

Yeah that's what I was looking for haha. Thank you for clearing that up!

So if I setup a cloud server upstream for recursive DNS, how do I secure it? To prevent DNS poisoning and other forms of attacks? Want to learn a bit about it. (I guess this part is off topic, if so, please do let me know : ) )

---

<div class="post-metadata">

**Author:** ![Bucking\_Horn](https://discourse-cdn.pi-hole.net/user_avatar/discourse.pi-hole.net/bucking_horn/32/18719_2.png) [@Bucking\_Horn](https://discourse.pi-hole.net/u/Bucking_Horn)\
**Post date:** [March 22, 2021, 8:33am UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/17 "2021-03-22T08:33:07Z")

</div>

Enable [DNSSEC](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions).  
It is the only way to determine whether DNS records are authentic and have not been tampered with by cryptographically signing and verifying the records.

All root servers and \>90% of tld servers support DNSSEC, while support in lower level domain servers is still improving.

---

<div class="post-metadata">

**Author:** ![nullptr](https://discourse-cdn.pi-hole.net/letter_avatar_proxy/v4/letter/n/c4cdca/32.png) [@nullptr](https://discourse.pi-hole.net/u/nullptr)\
**Post date:** [March 22, 2021, 11:26am UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/18 "2021-03-22T11:26:59Z")

</div>

Is there any way I can check if DNS requests were blocked? For example when I setup a recursive server on a cloud?

---

<div class="post-metadata">

**Author:** ![system](https://discourse.pi-hole.net/uploads/default/original/3X/7/c/7c8792f649eeb921c5d2b4c41564ffa873d9a2b8.png) [@system](https://discourse.pi-hole.net/u/system)\
**Post date:** [April 13, 2021, 4:43pm UTC](https://discourse.pi-hole.net/t/setup-with-unbound-vs-dnscrypt/45501/21 "2021-04-13T16:43:37Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.