onionvps

Guide

Private DNS with AdGuard Home and Unbound

Intermediate20 min readUpdated May 12, 2026
Short answer

AdGuard Home filters and serves DNS-over-HTTPS; Unbound behind it performs full recursion so no upstream resolver ever sees your queries. On a $4 instance the pair uses under 200 MB of RAM and replaces the single richest source of behavioural data about you — your ISP's resolver.

01 Install Unbound as a recursive resolver

Bind it to localhost on a non-standard port so AdGuard Home can take 53.

apt install -y unbound
cat >/etc/unbound/unbound.conf.d/local.conf <<'EOF'
server:
  interface: 127.0.0.1@5335
  do-ip6: yes
  prefetch: yes
  hide-identity: yes
  hide-version: yes
  qname-minimisation: yes
EOF
systemctl restart unbound

02 Install AdGuard Home

The installer sets up a systemd unit and a web interface on port 3000 for initial configuration.

curl -sSL https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v

03 Point AdGuard at Unbound

In Settings → DNS, set the upstream to 127.0.0.1:5335 and disable all other upstreams. Full recursion means no third party sees your queries at all.

04 Enable DNS-over-HTTPS

Get a certificate with Certbot, then enable DoH on 443 and DoT on 853 in the encryption settings. Clients then reach the resolver privately in transit as well as at rest.

certbot certonly --standalone -d dns.example.com

05 Lock it down

Restrict access by client IP, or require DoH with a secret path. An open resolver is recruited into DNS amplification attacks within days and will be null-routed.

Frequently asked questions

Is this better than a public resolver?

Privately, yes — no third party sees your queries at all with full recursion. Public resolvers are faster because of their cache size; the trade is speed for visibility.

How much does it cost to run?

$4 a month. It is the cheapest meaningful privacy improvement available.