Unbound (DNS server)

• Caching resolver with prefetching of popular items before they expire
• DNS over TLS forwarding and server, with domain-validation^[2]
• DNS over HTTPS^[3][4]
• DNS over QUIC^[5]
• Query name minimization^[6]
• Aggressive use of DNSSEC-Validated Cache^[7]
• Authority zones, for a local copy of the root zone^[8]
• DNS64
• DNSCrypt^[9]
• Domain Name System Security Extensions (DNSSEC) validating
• EDNS client subnet

Originally designed by Jakob Schlyter of Kirei and Roy Arends of Nominet in 2004, funding was provided by VeriSign and ep.net to develop a prototype written in Java (David Blacka and Matt Larson, VeriSign). In 2006, the prototype was re-written for high-performance in the C programming language by NLnet Labs.^[10]

Unbound is designed as a set of modular components that incorporate modern features, such as enhanced security (DNSSEC) validation, Internet Protocol Version 6 (IPv6), and a client resolver application programming interface library as an integral part of the architecture. Originally written for POSIX-compatible Unix-like operating system, it runs on FreeBSD, OpenBSD, NetBSD, macOS, and Linux, as well as Microsoft Windows.

Unbound has supplanted the Berkeley Internet Name Daemon (BIND) as the default, base-system name server in FreeBSD and OpenBSD, where it is perceived as smaller, more modern, and more secure for most applications.^[11][12]

• NSD, an authoritative name server, also from NLnet Labs
• Comparison of DNS server software