Hacker News Reader

Try NSD. Unlike unbound, NSD is the actual authoritative name server in the project.

I’m setting up NSD for authoratative and Unbound for recursive layer at my company and they are a breeze to work with.

I have this as well, but run a heavily locked down and isolated BIND server with NSD and Unbound for external authoritative and internal caching DNS respectively.

Its easy to feed an RBL to unbound to do pi-hole type work, I use pf to transparently redirect all external DNS requests to my local unbound server but I get the bind automation around things like DNSSEC, DHCP ddns and ACME cert renewals.

I'm surprised this isn't a more common stack.

Reply on news.ycombinator.com