Where Does Unbound Store DNS Config?
Unbound reads unbound.conf from /etc/unbound with zone and forward files beside it. Validate with unbound-checkconf before restarting.
Last updated
Unbound centers on one config file with includes. The main conf sets interfaces, access control, caching, and DNSSEC, while forward and stub zones branch into companion files. Package layouts vary slightly by distro but the conf name stays constant.
Cache and statistics live in memory, so restarts flush them; persistent data was never the point. Log verbosity climbs fast, so keep it low in production and raise it only while debugging. Pair with firewall rules allowing port 53 from intended clients only.
Where Unbound DNS stores this, by platform
/etc/unbound/unbound.conf
Main config plus zone includes. Validate with unbound-checkconf before every restart. Restarts flush cache; keep verbosity low in production.
Frequently asked questions
How do I test Unbound config safely?
Run unbound-checkconf against the file before restarting. A syntax slip kills resolution for the whole network behind it. Keep the previous conf copy until clients resolve correctly again.
How do I forward to upstream DNS?
Add forward-zone blocks pointing at the chosen resolvers with TLS settings where wanted. Local zones override public answers for homelab names. Order matters: local data first, forwarding second, recursion last.
Notice an outdated path? Let us know.