pi hole

How to Set Up Pi-hole with Unbound for Private DNS: Complete Guide 2026

by

If you manage even a small homelab, you’ve probably noticed ads following you across devices, or wondered whether your ISP is logging every site you visit. A Pi-hole Unbound private DNS setup fixes both problems on your own hardware.

What This Stack Does

Pi-hole blocks ads, trackers, and malicious domains at the DNS level for every device on your network. Unbound replaces your ISP’s resolver with a recursive, validating, no-log DNS resolver that queries root servers directly.

Together they give you:

  • Network-wide ad blocking without installing apps on each device
  • Privacy-first DNS with no upstream logging
  • Faster lookups thanks to local caching
  • A single dashboard for monitoring DNS traffic

Prerequisites

  • A Raspberry Pi 4/5, old laptop, or small VM
  • Raspberry Pi OS Lite or Debian/Ubuntu Server
  • Static IP for the DNS server
  • Router admin access to change DHCP DNS

Step 1: Install Pi-hole

Run the official installer:

curl -sSL https://install.pi-hole.net | bash

During setup, set a static IP like 192.168.1.10. Choose an upstream provider temporarily; we’ll replace it with Unbound later. Enable the web admin interface and query logging.

After install, point your router DHCP to 192.168.1.10 and test ad blocking from any client.

Step 2: Install Unbound

Install Unbound:

sudo apt update
sudo apt install unbound -y

Unbound listens on port 5335. Reconfigure Pi-hole to use Unbound as its only upstream instead of public resolvers.

Step 3: Configure Unbound

Create /etc/unbound/unbound.conf.d/pi-hole.conf:

server:
  interface: 127.0.0.1
  port: 5335
  do-ip4: yes
  do-udp: yes
  do-tcp: yes
  access-control: 127.0.0.1 allow
  private-address: 192.168.0.0/16
  private-address: 10.0.0.0/8
  private-address: 172.16.0.0/12
  cache-max-ttl: 86400
  prefetch: yes

Then restart Unbound:

sudo systemctl restart unbound

Step 4: Point Pi-hole to Unbound

In the Pi-hole web UI, set Upstream DNS Servers to 127.0.0.1#5335. Remove other public DNS entries, save, and apply.

Step 5: Harden the Setup

  • Enable DNS over HTTPS or DNS over TLS if your clients support it
  • Disable remote Unbound access; only allow localhost
  • Schedule regular Pi-hole gravity updates
  • Monitor query logs from the Pi-hole dashboard

Why This Works Better

Most guides stop at Pi-hole with public upstreams. That still leaks metadata. Adding Unbound gives you a true private DNS setup: cached, encrypted-capable, and self-hosted. It’s one of the highest-impact homelab services because every device benefits automatically.

Final Thoughts

A Pi-hole Unbound private DNS server takes under an hour to deploy, costs almost nothing to run, and immediately improves privacy and browsing speed. Once it’s running, expand it with VLANs, per-client blocking rules, and conditional forwarding for internal domains.

Leave a Comment