Unbound DNS Resolver

Unbound is a validating, recursive, and caching DNS resolver designed for high performance, security, and standards compliance. Developed by NLnet Labs since 2007, Unbound is widely used by internet service providers, enterprises, and the root DNS infrastructure for recursive DNS resolution. Key features include: DNSSEC validation (full recursive DNSSEC validation with built-in trust anchor, automatic algorithm rollover, and aggressive NSEC caching to synthesize negative answers from authenticated denial-of-existence records), recursive resolution (iterative DNS resolution starting from root servers through TLD servers to authoritative servers, with configurable stub zones for custom resolution paths), prefetching (proactively refreshes cache entries before TTL expiration to maintain warm cache and reduce user-visible latency), response Rate Limiting (RRL to protect against DNS amplification attacks by limiting response rates per source IP), query name minimization (RFC 7816 compliance for privacy-enhancing DNS resolution by sending only the minimum necessary labels to each authoritative server), local data (serve custom DNS records locally for internal services, split-horizon DNS, and ad blocking via local zone overrides), Python module (embedded Python interpreter for custom query processing, response modification, and complex policy implementation), DNS64 (IPv6 address synthesis for IPv6-only networks communicating with IPv4-only servers), EDNS Client Subnet (ECS support for CDN optimization by forwarding client subnet information), and high performance (multi-threaded architecture with per-thread query state, event-based I/O using libevent or internal event loop, serving millions of queries per second on commodity hardware).