#DNS Security

#Architecture Stack

1. Unbound recursive resolver: validates DNSSEC, queries root servers directly, no upstream forwarders
2. AdGuard Home or Pi-hole sinkhole layer in front of Unbound
3. DNS-over-TLS (DoT) for any forwarded queries (port 853)
4. Firewall rule: block ALL outbound port 53 except from your resolver. NAT redirect rogue DNS to 127.0.0.1:53

#DNSSEC with Unbound

Key config:

auto-trust-anchor-file: "/var/lib/unbound/root.key"  # RFC 5011 auto-managed
val-clean-additional: yes                              # remove unvalidated data
harden-glue: yes                                       # trust glue within delegation only
harden-dnssec-stripped: yes                            # require DNSSEC for signed zones

#Additional Hardening

use-caps-for-id: yes       # 0x20 encoding against cache poisoning
ip-ratelimit: 1000         # prevents DNS amplification if exposed
harden-below-nxdomain: yes
harden-referral-path: yes

#Hardened Unbound Config

Community-maintained, DoT 1.3 via Cloudflare + CleanBrowsing, DNSSEC, multi-threaded: https://gist.github.com/timothymiller/79fd2a99fb1a14b82fbf7c72b77a582c

OPNsense ships with Unbound integrated: https://docs.opnsense.org/manual/unbound.html

#References

• DNSSEC-aware Unbound: https://feeding.cloud.geek.nz/posts/setting-up-your-own-dnssec-aware/
• Unbound with DoT + DNSSEC: https://blog.cyclemap.link/2020-01-11-unbound/
• Pi-hole + Unbound + DNSSEC: https://botmonster.com/self-hosting/secure-local-dns-unbound-pihole-privacy/
• NLnet Labs advisories: https://www.nlnetlabs.nl/projects/unbound/security-advisories/

#NSA DNS Guidance

Three documents covering the full spectrum:

1. Defending Your DNS Infrastructure (DNSSEC)
2. Adopting Encrypted DNS (DoH/DoT)
3. Selecting a Protective DNS Service (PDNS)

See government-guides/nsa.md for URLs.