onionvps

Solution

VPS for private DNS: Pi-hole, AdGuard Home and Unbound

Skiff 1 · $4/moSkiff 2 · $7/mo
Short answer

Recursive DNS is the lightest useful workload there is: one shared core and 1 GB of RAM serve a household or a small team with room to spare. Running Unbound behind AdGuard Home means no upstream resolver ever sees your queries, and DNS-over-HTTPS on port 443 keeps them private in transit — which matters more than the hardware.

What you need

Specification floor for private dns & ad blocking
ResourceWhat you actually need
CPU1 shared core
RAM1 GB (512 MB is enough for Unbound alone)
Disk20 GB
NetworkStatic IPv4 and IPv6; low latency to your users

Recommended plans

Skiff

Skiff 1

$ 4 /month
vCPU
1 × shared
RAM
1 GB
Storage
20 GB NVMe SSD
Transfer
2 TB
IPv4 / IPv6
1 / /64 routed
Configure
Skiff

Skiff 2

$ 7 /month
vCPU
1 × shared
RAM
2 GB
Storage
40 GB NVMe SSD
Transfer
3 TB
IPv4 / IPv6
1 / /64 routed
Configure

Recommended locations

Location is usually the decision that matters most for this workload — either because latency dominates, or because jurisdiction does.

🇨🇭

Zurich

Switzerland No alliance

🇮🇸

Reykjavík

Iceland No alliance

🇵🇦

Panama City

Panama No alliance

🇳🇱

Amsterdam

Netherlands 9 Eyes

🇸🇬

Singapore

Singapore No alliance

Why OnionVPS for this

  • A $4 instance replaces your ISP's resolver, which is one of the richest sources of behavioural data about you.
  • We keep no query logs and no netflow, so the resolver is genuinely yours.
  • Native IPv6 lets clients resolve over v6 without a translation layer.
  • Jurisdictions with no data-retention mandate mean there is no legal duty to start logging later.

How to set it up

  1. Deploy a Skiff 1 in a privacy jurisdiction

    Switzerland, Iceland and Panama are the usual picks.

  2. Install AdGuard Home

    It ships DNS-over-HTTPS and DNS-over-TLS out of the box.

  3. Point it at a local Unbound instance

    Full recursion means no upstream resolver sees your queries at all.

  4. Enable DoH on 443 and DoT on 853

    Get a certificate with Certbot; both are one config line away.

  5. Lock it down

    Restrict by client IP or require DoH with a secret path — open resolvers are used in amplification attacks.

Frequently asked questions

Why run your own DNS server?

Your resolver sees every domain you visit before any encryption applies. Running your own moves that visibility from your ISP or a public resolver to a machine you control in a jurisdiction you chose.

Does Pi-hole need much CPU?

Almost none. A shared core and 1 GB of RAM handle thousands of queries a minute; the workload is memory lookups, not computation.

Can I use it as a public resolver?

You can, but do not leave it open. Open resolvers are recruited into DNS amplification attacks, which will get the instance null-routed.