Knowledgebase

By default, VPS servers rely on external DNS resolvers provided by the ISP or public providers like Google or Cloudflare. Configuring a local recursive DNS resolver using Unbound improves query resolution speed, enhances privacy, and ensures high availability with fallback support on Debian 13 (Trixie).

This guide walks you through setting up Unbound DNS resolver and integrating it seamlessly with systemd-resolved and Netplan.

Step 1: Install and Configure Unbound

Run the following commands to install Unbound and temporarily stop the service while editing configuration:

apt update && apt install unbound -y
systemctl stop unbound

Create a custom Unbound configuration file:

nano /etc/unbound/unbound.conf.d/local-resolver.conf

Paste the following configuration into the file:

server:
    interface: 127.0.0.2
    port: 53
    do-ip4: yes
    do-ip6: no
    access-control: 127.0.0.2/32 allow
    access-control: 0.0.0.0/0 refuse
    hide-identity: yes
    hide-version: yes
    harden-glue: yes
    harden-dnssec-stripped: yes
    cache-min-ttl: 300
    cache-max-ttl: 86400
    prefetch: yes

Enable and start the Unbound service:

systemctl enable unbound
systemctl restart unbound

Step 2: Configure systemd-resolved

Stop systemd-resolved to update its settings:

systemctl stop systemd-resolved
mkdir -p /etc/systemd/resolved.conf.d/
nano /etc/systemd/resolved.conf.d/custom.conf

Add the following lines to configure local DNS resolution alongside public fallbacks:

[Resolve]
DNS=127.0.0.2
FallbackDNS=8.8.8.8 1.1.1.1 2001:4860:4860::8888
DNSStubListener=no

Step 3: Disable DHCP DNS Overrides via Netplan

Prevent your Cloud provider's DHCP from overwriting local DNS settings by creating a Netplan override configuration:

nano /etc/netplan/99-dns-override.yaml

Add the following YAML block:

network:
  version: 2
  ethernets:
    all-en:
      match:
        name: "en*"
      dhcp4-overrides:
        use-dns: false
      dhcp6-overrides:
        use-dns: false

Apply the Netplan configuration:

netplan generate
netplan apply

Step 4: Update Symlink and Restart System Services

Unlock /etc/resolv.conf if immutable, remove it, and recreate the proper symlink:

chattr -i /etc/resolv.conf 2>/dev/null
rm -f /etc/resolv.conf
ln -s /run/systemd/resolve/resolv.conf /etc/resolv.conf

Enable and restart systemd-resolved:

systemctl enable systemd-resolved
systemctl restart systemd-resolved

Step 5: Verify Configuration

Verify that /etc/resolv.conf correctly points to 127.0.0.2:

cat /etc/resolv.conf

Check the active resolver status using resolvectl:

resolvectl status