Unbound configuration clarity

This is our guide, hosted on our site.

The answer to both is no. The person who posted that guide may think they are important, but as one example, I have five instance of unbound running on various Pi-holes using the Pi-hole guide, with no problems.

  1. Leave the Pi-hole cache enabled. There is no problem with having multiple caches. Your client and browser cache as well, and you likely aren't disabling those caches either.

  2. Enabling DNSSEC in Pi-hole doesn't waste time. Unbound is doing the DNSSEC, and when you enable DNSSEC in Pi-hole you add the DNSSEC status in the status column of the query log. Storing DNSSEC information does slightly increase the size of your long term database since there is additional information stored with DNSSEC enabled.

DNSSEC will be done by unbound whether or not you enable DNSSEC in Pi-hole.

Also note that on the web you will find older recommendations to not enable DNSSEC in Pi-hole with unbound due to performance issues. This was true with versions of dnsmasq prior to 2.80 (bugs in dnsmasq). We currently ship with dnsmasq 2.82 and this problem exists no longer.

Note that the guide provided by that user has a number of other changes that they recommend but that the Pi-hole developers do not. Feel free to use that guide if you wish, but if you have subsequent problems using that guide, open an issue on their Gitbhub page.

Note also that the website you reference bases their configuration on our guide, with no attribution or credit to the origin of the guide they are using. They have recently stripped out some of the text they had taken verbatim from our guide:

https://github.com/anudeepND/pihole-unbound/commit/f064bf3a12dcc8f726737cd665361ac660d2a20f

They also recently dropped their donation section at the bottom of that page.

https://github.com/anudeepND/pihole-unbound/issues/8