---
type: entity
title: unbound
tags: [dns, resolver, software]
related: [dnssec, sshfp]
created: 2026-07-01
updated: 2026-07-01
sources: ["output/rz_uni_greifswald_de_support_dokumentation_anleitungen_dnssec_macos.md"]
---

# unbound

**unbound** is a validating, recursive, and caching DNS resolver designed to be secure and performant. It is primarily used to implement [[dnssec]] validation on local machines.

## Features and Configuration
- **DNSSEC Validation:** It uses trust anchors (such as the DNS root zone key) to validate the authenticity of DNS responses.
- **Security Best Practices:** It is recommended to run `unbound` under an unprivileged user account (e.g., `_unbound`) to limit the impact of a potential system compromise.
- **Integration:** On macOS, it can be installed via Homebrew and managed as a system service using `launchd` (via `.plist` files).
