TransWikia.com

What is the difference between unbound and unwind?

Unix & Linux Asked by Bex on December 4, 2020

Reading the man pages of OpenBSD gives me

unwind - validating DNS resolver

and

unbound - Unbound DNS validating resolver 1.11.0

which begs the question – what is the difference between these programs, and which should I prefer?

One Answer

The DNS client libraries linked into your applications softwares talk to a proxy DNS server to do all of the work. Proxy DNS servers come in two kinds: resolving proxy DNS servers do all of the work of query resolution themselves, and forwarding proxy DNS servers simply send the same queries from their back ends out to other proxy DNS servers.

This is essentially the difference between unbound and unwind.

  • unbound is a resolving proxy DNS server, that is configured with a set of content DNS servers to start from, and that issues all of the back-end queries necessary to perform all of the grunt work of query resolution, combining what is returned to it in order to return the final full answer on its front end.

    unbound is the conventional form of resolving proxy DNS server, for machines with consistent and stable connections to Internet.
  • unwind is a forwarding proxy DNS server, that is configured with a set of forwardee proxy DNS servers to forward on to, and rules about when to switch to and from using the proxy DNS servers provided by SLAAC and DHCP.

    unwind is a forwarder for machines with inconsistent and unstable connections to Internet, where query resolution is done either:
    • by a resolving proxy DNS server running on a machine elsewhere (on the LAN, or externally at a third party such as IBM/Quad9 or Cloudflare), or
    • by an ISP-provided resolving proxy DNS server when one is behind a captive portal and has not yet logged in.

In a not-logged-in ISP's captive network, a conventional resolving proxy DNS server is unable to reach the public content DNS servers on Internet and thus does not work; unless it is explicitly configured with overrides for the particular domain names used by the ISP's captive portal, which is easy to do for specific ISPs one by one, but hard to automate in the general case.

One can even use both in conjunction, unwind listening on 127.0.0.1, handling when to switch from captive to normal mode, and configured to forward to unbound, in its turn listening on (say) 127.0.0.2, and doing query resolution locally on the same machine.

Further reading

Correct answer by JdeBP on December 4, 2020

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP