# DNS Security

## Architecture Stack

1. **Unbound** recursive resolver: validates DNSSEC, queries root servers directly, no upstream forwarders
2. **AdGuard Home** or **Pi-hole** sinkhole layer in front of Unbound
3. **DNS-over-TLS (DoT)** for any forwarded queries (port 853)
4. **Firewall rule**: block ALL outbound port 53 except from your resolver. NAT redirect rogue DNS to 127.0.0.1:53

## DNSSEC with Unbound

Key config:
```
auto-trust-anchor-file: "/var/lib/unbound/root.key"  # RFC 5011 auto-managed
val-clean-additional: yes                              # remove unvalidated data
harden-glue: yes                                       # trust glue within delegation only
harden-dnssec-stripped: yes                            # require DNSSEC for signed zones
```

## Additional Hardening

```
use-caps-for-id: yes       # 0x20 encoding against cache poisoning
ip-ratelimit: 1000         # prevents DNS amplification if exposed
harden-below-nxdomain: yes
harden-referral-path: yes
```

## Hardened Unbound Config

Community-maintained, DoT 1.3 via Cloudflare + CleanBrowsing, DNSSEC, multi-threaded:
https://gist.github.com/timothymiller/79fd2a99fb1a14b82fbf7c72b77a582c

OPNsense ships with Unbound integrated:
https://docs.opnsense.org/manual/unbound.html

## References

- DNSSEC-aware Unbound: https://feeding.cloud.geek.nz/posts/setting-up-your-own-dnssec-aware/
- Unbound with DoT + DNSSEC: https://blog.cyclemap.link/2020-01-11-unbound/
- Pi-hole + Unbound + DNSSEC: https://botmonster.com/self-hosting/secure-local-dns-unbound-pihole-privacy/
- NLnet Labs advisories: https://www.nlnetlabs.nl/projects/unbound/security-advisories/

## NSA DNS Guidance

Three documents covering the full spectrum:
1. Defending Your DNS Infrastructure (DNSSEC)
2. Adopting Encrypted DNS (DoH/DoT)
3. Selecting a Protective DNS Service (PDNS)

See government-guides/nsa.md for URLs.