techblog 

Today, NLnet Labs released Unbound. A high performance, validating caching resolver implementation. It is fully DNSSEC-aware, up to the very latest standards such as NSEC3 and Opt-Out. Even if you don’t use DNSSEC, it is highly resilient to forgeries. It is the natural counterpart of NSD, NLnet Labs’ authoritative server.

The architectural concept behind unbound was developed in 2004. The modular design came from a wish to constrain complexity to very small modules. David Blacka implemented a prototype in Java, and Matt larson and others helped to make it fully featured. By the end of 2006, the prototype was done, and has been used in many standardization efforts in the IETF.

By that time, NLnet Labs became interested in building a validating caching resolver. Though inspired by early prototype, the C version is completely built from scratch. If you’ve ever used NSD, and appreciate the clarity, quality and robustness of the source code, then Unbound should not surprise you.

Unbound is very, very fast. It easily outperforms other DNS resolvers like PowerDNS or BIND. It runs on Linux, *BSD, Solaris, MacOSX. We expect Unbound to find its way to ISPs and other production level environments. NLnet Labs is committed to support Unbound. Any changes to that support will be notified two years in advance.