Packages / unbound
APT repository · deb.freshdeb.com/unboundprinted 28 Oct 2026, 13:16 UTC
unbound
Unbound, NLnet Labs' validating, recursive and caching DNS resolver, with DNSSEC validation, DNS over TLS and HTTPS, and a library for resolving and validating from your own programs. One release line for Debian 12 and 13, Ubuntu 22.04, 24.04 and 26.04 on amd64 and arm64.
latest 1.26.2nlnetlabs.nl/projects/unboundupstream sourcepackaging
Componentmain
follows every upstream release, minors and majors included. Currently 1.26.2.
Not published yet. The first unbound release is being built. These commands will work once it lands at deb.freshdeb.com/unbound; the versions shown are the ones package.yaml will publish.
1Trust the signing key (once per machine)
sudo install -d -m 0755 /etc/apt/keyrings curl -fsSL https://deb.freshdeb.com/freshdeb-archive-keyring.gpg \ | sudo tee /etc/apt/keyrings/freshdeb-archive-keyring.gpg >/dev/null
Fingerprint 3BBD F03A 9C0B F890 F8CA 9510 7595 CC55 468F 3161. How to verify.
2Add the source
sudo tee /etc/apt/sources.list.d/freshdeb-unbound.sources >/dev/null <<EOF
Types: deb
URIs: https://deb.freshdeb.com/unbound
Suites: $(. /etc/os-release && echo $VERSION_CODENAME)
Components: main
Signed-By: /etc/apt/keyrings/freshdeb-archive-keyring.gpg
EOFWith auto, the shell reads the codename from /etc/os-release on the machine you paste this into.
3Install
sudo apt update && sudo apt install unbound
apt policy unbound # expect 1.26.2-1+freshdeb~…Before you upgrade from the distribution's unbound
The freshdeb version sorts higher, so apt upgrade moves you over in place. Configurations keep working, but some defaults changed. With EDNS client subnet compiled in, module-config no longer gets subnetcache on its own: set it yourself if you use ECS. With serve-expired on, expired answers are kept for a day (serve-expired-ttl 86400) and clients wait 1.8 s before getting one. resolver.arpa. and service.arpa. are answered locally, cached records expire at TTL 0, and tls-protocols picks the TLS versions. The package's NEWS entry has the details.
Compared with Debian's package
Debian's packaging decides where things go: package names, paths, users, services and how upgrades behave. The build follows upstream's own release builds wherever Debian's differs.
- Build
- Debian's packaging, from NLnet Labs' release tarball. It patches nothing upstream and builds with the Python module, EDNS client subnet, dnstap, cachedb with Redis, DNS over HTTPS and systemd support.
- Library
libunbound8replaces the distribution's: the same soname, and Debian's symbols only add to it, so programs built against the old one keep working.- Layout
- Debian's:
/etc/unbound/unbound.confandunbound.conf.d, theunbounduser, the root trust anchor kept current byunbound-anchor, and the systemd unit.
Packing list
Every release line of unbound and the distributions it's built for. Each line is its own APT component and only gets the releases it follows (main: every upstream release, minors and majors included). After upstream end of life it stops building but stays installable. Hatched cells have no build: usually that distribution already ships the same or a newer version itself.
| Line | Component | Current | bookwormDebian 12 | trixieDebian 13 | jammyUbuntu 22.04 | nobleUbuntu 24.04 | resoluteUbuntu 26.04 | Support |
|---|---|---|---|---|---|---|---|---|
| main | main | 1.26.2 | built: 1.26.2-1 | built: 1.26.2-1 | built: 1.26.2-1 | built: 1.26.2-1 | built: 1.26.2-1 | – |
Versions follow <upstream>-<revision>+freshdeb~<distro>, distro being deb12, deb13, ubuntu22.04, ubuntu24.04 or ubuntu26.04, for amd64 and arm64. Published versions are never rebuilt or replaced.
Contents
- libunbound-dev
- Headers and the static library, for building against libunbound.
- libunbound8
- The resolver library.
- python3-unbound
- Python bindings for libunbound.
- unbound
- The resolver, with unbound-control and unbound-checkconf.
- unbound-anchor
- Fetches and updates the root DNSSEC trust anchor.
- unbound-host
- A host-like lookup tool that validates DNSSEC.
Origin
- Upstream
- github.com/NLnetLabs/unboundrelease tags pinned to commit hashes, built from the checksummed release tarball
- Debian packaging
- salsa.debian.org/dns-team/unboundimported unmodified at 8d5bece (1.26.2-1, unstable)
- Our changes
- overlays under
overlays/for bookworm, trixie, jammy, noble, resolute. - Built for
- bookworm, trixie, jammy, noble, resoluteamd64, arm64, built natively
- Files
- package.yaml · debian/ · report an issuepackage.yaml explains every change
Also in Networking
- bgpq41.16BGP prefix and AS-path filter generator for IRR routing datamain
- frp0.71.1Reverse proxy to servers behind NAT, with the web dashboardsmain
- headscale0.29.6Self-hosted Tailscale control server, one line per minor0.29latest
- keepalived2.4.3VRRP failover and health checking for Linux Virtual Servermain
- nmap7.992Network scanner, with ncat, ndiff and zenmapmain
