How to Set Up Pi-hole with Unbound for Private DNS

Pi-hole is great at blocking ads network-wide, but by default it still forwards your DNS queries to a third-party provider like Cloudflare or Google. Setting up Pi-hole with Unbound removes that dependency entirely, giving you a fully private, recursive DNS resolver that answers queries directly from the source instead of relying on any external DNS provider.

Why Add Unbound to Pi-hole?

Pi-hole alone blocks ad and tracker domains, but every non-blocked query still gets sent to whichever upstream DNS server you’ve configured — meaning that provider can still see and log every domain you visit. Unbound solves this by having your own server resolve DNS queries directly against the domain’s authoritative name servers, so no third party ever sees your browsing patterns.

What Is Unbound?

Unbound is a lightweight, open-source recursive DNS resolver. Instead of forwarding queries to an upstream provider, it performs the full resolution process itself: starting at the root DNS servers, then following the chain down through top-level domains until it reaches the authoritative answer, all cached locally for faster repeat lookups.

Installing Unbound

On Debian or Ubuntu-based systems:

sudo apt update
sudo apt install unbound -y

Configuring Unbound

Create a configuration file for Pi-hole integration:

sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf

Add a configuration block setting Unbound to listen locally, enable DNSSEC validation, and specify appropriate cache and privacy settings. Root hints (a list of the internet’s root DNS servers) also need to be downloaded so Unbound knows where to start its resolution process:

sudo wget -O /var/lib/unbound/root.hints https://www.internic.net/domain/named.root

Restart Unbound to apply the configuration:

sudo systemctl restart unbound

Testing Unbound Independently

Before connecting it to Pi-hole, confirm Unbound is resolving correctly on its own:

dig pi-hole.net @127.0.0.1 -p 5335

A successful response confirms Unbound is working as expected on port 5335 (the typical port used for this setup, separate from Pi-hole’s own port 53).

Connecting Pi-hole to Unbound

1. Open the Pi-hole admin dashboard.
2. Go to Settings → DNS.
3. Uncheck any existing upstream DNS providers (like Cloudflare or Google).
4. Under Custom 1 (IPv4), enter 127.0.0.1#5335.
5. Save the settings.

From this point forward, Pi-hole forwards all non-blocked queries to your local Unbound instance instead of any external DNS provider.

Verifying Everything Works Together

Check the Pi-hole query log to confirm DNS requests are being resolved through the local Unbound resolver rather than an external upstream server, and run a speed comparison to ensure lookups still feel responsive after the switch — Unbound’s local caching typically keeps repeat queries just as fast as before.

Final Thoughts

Combining Pi-hole with Unbound gives you a DNS setup that blocks ads and trackers while also removing your reliance on any third-party DNS provider entirely. For homelab users who care about privacy as much as ad-blocking, this pairing is one of the most valuable upgrades you can make to a standard Pi-hole installation.