How to Set Up Your Own DNS Server — Full Guide

Running your own DNS server gives you control over how DNS queries are resolved on your network. You can block domains, cache responses for faster lookups, resolve local hostnames, and reduce reliance on external DNS providers. It is not for everyone, but if you manage a network and want more control, it is worth doing.

There are three main DNS server software options: BIND, Unbound, and Dnsmasq. Each serves a different purpose. BIND is the full-featured authoritative and recursive server. Unbound is a validating recursive resolver focused on security. Dnsmasq is a lightweight forwarder designed for small networks.

This guide covers setting up each one on Linux. The same principles apply if you use a different operating system, but the package names and configuration paths will differ.

Which DNS Server Should You Use?

Your choice depends on what you need. If you want to host authoritative DNS for your own domains, use BIND. It is the most complete DNS server software available, supporting every record type, DNSSEC, zone transfers, and views. BIND is complex but powerful.

If you want a recursive resolver that validates DNSSEC and blocks malicious domains, use Unbound. It is designed for security and performance as a recursive resolver. Unbound is simpler to configure than BIND for recursive resolution and does DNSSEC validation out of the box.

If you want a simple DNS forwarder with caching and DHCP for your home network, use Dnsmasq. It is lightweight, easy to configure, and runs on resource-constrained devices like Raspberry Pi. Dnsmasq is the engine behind many home router DNS implementations.

Setting Up BIND

BIND (Berkeley Internet Name Domain) is the most widely used DNS server software. Install it on Ubuntu or Debian with: sudo apt update && sudo apt install bind9. On CentOS or RHEL: sudo dnf install bind.

The main configuration file is /etc/bind/named.conf on Debian or /etc/named.conf on CentOS. BIND's configuration has three main sections: options (global settings), zone definitions (which domains you are authoritative for), and logging configuration.

To set up a simple caching resolver, configure BIND to forward queries to an upstream DNS provider and cache the results. This is the simplest BIND setup and provides local caching for your network. Edit the options section to include forwarders like 1.1.1.1 and 8.8.8.8.

To host authoritative DNS for your own domain, create a zone file with your DNS records and add a zone definition to named.conf. See our DNS zone file guide for the zone file format. After configuration, restart BIND: sudo systemctl restart named or sudo systemctl restart bind9.

Setting Up Unbound

Unbound is designed as a recursive, validating DNS resolver. Install it with: sudo apt install unbound on Debian/Ubuntu or sudo dnf install unbound on CentOS/RHEL.

The configuration file is /etc/unbound/unbound.conf. The default configuration works as a basic recursive resolver. Unbound will query the root nameservers directly and build the DNS resolution chain itself, validating DNSSEC signatures along the way.

For better performance, enable caching and prefetching. Unbound can prefetch popular records before they expire, keeping its cache warm. Add prefetch: yes and cache-min-ttl: 300 to your configuration. This significantly improves resolution speed for frequently queried domains.

Unbound also supports DNS over TLS outbound. Configure forward-zone entries pointing to Cloudflare or Quad9 with TLS enabled. This encrypts your DNS queries between your server and the upstream resolver, adding privacy to your recursive resolution.

Setting Up Dnsmasq

Dnsmasq is the simplest DNS server to set up. Install it with: sudo apt install dnsmasq or sudo dnf install dnsmasq. The configuration file is /etc/dnsmasq.conf.

A basic Dnsmasq configuration sets the upstream DNS servers, enables DHCP, and configures local domain resolution. Dnsmasq's configuration is line-based and uses simple key-value pairs. There is no complex syntax to learn.

To set up Dnsmasq as a DNS forwarder with caching, specify upstream servers with the server directive: server=1.1.1.1 and server=8.8.8.8. Dnsmasq will forward queries to these servers and cache the results. Add cache-size=10000 to increase the cache size from the default of 150 entries.

Dnsmasq also provides DHCP server functionality. Configure the DHCP range, lease time, and router address in the same configuration file. This makes Dnsmasq an excellent all-in-one solution for home and small office networks.

Testing Your DNS Server

After setting up your DNS server, test that it resolves queries correctly. Use dig to query your server directly: dig @127.0.0.1 example.com. If the server is running on a different machine, replace 127.0.0.1 with the server's IP address.

Check that DNSSEC validation is working. Query a domain that uses DNSSEC and check for the ad flag: dig @127.0.0.1 dnssec-enabled-domain.com +dnssec. If the ad flag is present in the response, DNSSEC validation is functioning.

Configure your devices or router to use your DNS server. On your router, set the DNS server to the IP of your DNS server. On individual devices, change the DNS settings in the network configuration. Test that browsing works and DNS resolution is faster than before.

For detailed guides on the individual DNS servers, see our pages on BIND, Unbound, and Dnsmasq.