Your ISP’s default DNS sees every site you visit. Ads follow you across devices. Phishing domains slip through because upstream resolvers cache compromised records. A Pi-hole Unbound private DNS stack fixes all of that on your own hardware.

What This Stack Does

Pi-hole blocks ads, trackers, and malicious domains at the DNS level for every device on your network. Unbound replaces your ISP’s resolver with a recursive, validating, no-log DNS resolver that queries root servers directly.

Together they give you:

• Network-wide ad blocking without installing apps on each device
• Privacy-first DNS with no upstream logging
• Faster lookups thanks to local caching
• A single pane of glass for monitoring DNS traffic

Step 1: Install Pi-hole

curl -sSL https://install.pi-hole.net | bash

During setup: – Set static IP, e.g. 192.168.1.10 – Choose your upstream provider temporarily; we’ll replace it with Unbound later – Enable the web admin interface and query logging

After install, point your router DHCP to 192.168.1.10 and test ad blocking from a client.

Step 2: Install Unbound

sudo apt update
sudo apt install unbound -y

Unbound runs on port 53 by default. Since Pi-hole also listens on 53, reconfigure Pi-hole to use Unbound as its only upstream instead of public resolvers. Step 3: Configure Unbound as a Private Resolver

Edit /etc/unbound/unbound.conf.d/pi-hole.conf

server:
  interface: 127.0.0.1
  port: 5335
  do-ip4: yes
  do-udp: yes
  do-tcp: yes
  access-control: 127.0.0.1 allow
  private-address: 192.168.0.0/16
  private-address: 10.0.0.0/8
  private-address: 172.16.0.0/12
  cache-max-ttl: 86400
  prefetch: yes

Then restart Unbound:

sudo systemctl restart unbound

Step 4: Point Pi-hole to Unbound

In the Pi-hole web UI:

– Set Upstream DNS Servers to 127.0.0.1#5335

– Remove other public DNS entries

– Save and apply

Step 5: Harden the Setup

• Enable DNS over HTTPS or DNS over TLS if your clients support it
• Disable remote Unbound access; only allow localhost
• Schedule regular Pi-hole gravity updates
• Monitor query logs from the Pi-hole dashboard

Why This Works Better

Most guides stop at Pi-hole with public upstreams. That still leaks metadata. Adding Unbound gives you a true private DNS setup: cached, encrypted-capable, and self-hosted. It’s one of the highest-impact homelab services because every device benefits automatically.

Final Thoughts

A Pi-hole Unbound private DNS server takes under an hour to deploy, costs almost nothing to run, and immediately improves privacy and browsing speed. Once it’s running, you can expand with VLANs, per-client blocking rules, and conditional forwarding for internal domains.

Related Posts

• How to Set Up a WireGuard VPN Server on Linux
• How to Set Up Nginx Proxy Manager for Your Home Lab
• How to Set Up Pi-hole with Unbound for Private DNS