In the digital age, our internet activity is tracked by countless entities—from the websites we visit to the networks that connect us. While some tracking is necessary for targeted services, many users are increasingly concerned about their Internet Service Provider (ISP) having a clear record of every website they visit.
But what if you could significantly enhance your privacy and keep your browsing history private from even your ISP? The answer lies in combining powerful, open-source tools like Pi-hole and Unbound.
What Are We Doing Here?
Normally, when you type a website name (e.g., example.com) into your browser, your computer sends a request called a DNS query to an external server (often managed by your ISP). This query essentially says, “What is the IP address for example.com?” Your ISP logs this entire conversation—creating a detailed map of every site you’ve ever accessed.
By implementing Unbound and properly configuring it with Pi-hole, we intercept these queries before they leave your home network and force them to go through an encrypted tunnel directly to a privacy-focused external resolver, making the connection effectively invisible to your ISP.
The Power Duo: Pi-hole and Unbound
Pi-hole is primarily a network-level ad blocker and DNS sinkhole. It intercepts queries at your router level, preventing malicious or annoying domains from ever loading.
Unbound is a validating, recursive, and non-caching DNS resolver. This means it doesn’t trust the answers given to it by default; instead, it validates them rigorously. When combined with encrypted connections (like DNS-over-TLS), it ensures that your query travels securely and privately to its destination.
The Advanced Configuration: Adding a Shield
The key step is telling Unbound not to use the standard, easily monitored upstream resolvers, but instead to tunnel all queries over TLS to highly private services like Cloudflare or Quad9.
Here is an example of how you would configure this within your Unbound setup (sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf):
Add this where you find prefetch: yes and replace with:
# --- ADVANCED CACHE PERFORMANCE TWEAKS ---
# Prefetch popular blocks before they expire to keep browsing fast
prefetch: yes
prefetch-key: yes
# Serve expired cache elements if upstream is temporarily slow
serve-expired: yes
serve-expired-ttl: 86400
# Expand cache size limits for smoother local lookups
msg-cache-size: 64m
rrset-cache-size: 128m
tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"
Add the below snippet to the bottom of the file:
# --- HIDE UPSTREAM QUERIES FROM ISP (DNS-over-TLS) ---
forward-zone:
name: "."
forward-tls-upstream: yes
# Cloudflare DNS over TLS (Primary & Secondary)
forward-addr: 1.1.1.1@853#cloudflare-dns.com
forward-addr: 1.0.0.1@853#cloudflare-dns.com
# Quad9 DNS over TLS (Alternative Privacy Option)
forward-addr: 9.9.9.9@853#dns.quad9.netSave and close file, then you want to check we have not broken anything:
sudo unbound-checkconfAnd restart unbound:
sudo systemctl restart unboundFinally you want to just check unbound is still running fine:
sudo systemctl status unbound
● unbound.service - Unbound DNS server
Loaded: loaded (/usr/lib/systemd/system/unbound.service; enabled; preset: enabled)
Active: active (running) since Thu 2026-08-20 11:40:27 BST; 1h 3min ago
Invocation: eca033f40eff4fe0aab5bda705cd1fb6
Docs: man:unbound(8)
Process: 1304 ExecStartPre=/usr/libexec/unbound-helper chroot_setup (code=exited, status=0/SUCCESS)
Process: 1307 ExecStartPre=/usr/libexec/unbound-helper root_trust_anchor_update (code=exited, status=0/SUCCE>
Main PID: 1310 (unbound)
Tasks: 1 (limit: 806)
CPU: 28.518s
CGroup: /system.slice/unbound.service
└─1310 /usr/sbin/unbound -d -p
Aug 20 11:40:26 pi.hole systemd[1]: Starting unbound.service - Unbound DNS server...
Aug 20 11:40:27 pi.hole unbound[1310]: [1310:0] info: start of service (unbound 1.22.0).
Aug 20 11:40:27 pi.hole systemd[1]: Started unbound.service - Unbound DNS server.What the code does:
forward-tls-upstream: yes: This is the magic line that instructs Unbound to use encrypted DNS over TLS (DoT) when reaching external servers.forward-addr: ...@853#...: By specifying addresses on port 853, we explicitly route our queries through major privacy providers like Cloudflare and Quad9.
By adopting this setup, your ISP can still see that you connected to your own router, but they will not be able to see the subsequent requests from your router—the actual websites you are accessing—leaving your browsing habit a mystery to them.
You can test and confirm by visiting 1.1.1.1/help in your web browser or running this command in your terminal dig deb.debian.org @1.1.1.1 +tls
You should see – Using DNS over TLS (DoT): Yes
This proves your local Unbound service is successfully intercepting your DNS requests, wrapping them in secure TLS encryption, and routing them over port 853. Your ISP can no longer see what websites you are visiting.
Final Thoughts on Privacy
No single tool provides perfect anonymity; privacy is always about layers of defense. However, using robust, open-source solutions like Pi-hole and Unbound offers dramatic improvements in visibility protection right at the source: your home network.
Give these powerful tools a look, secure your digital frontier, and enjoy true peace of mind while you browse!
Comments are closed