Identity

Unit: unbound.service
Config: /etc/unbound/unbound.conf, /etc/unbound/unbound.conf.d/
Root hints: /usr/share/dns/root.hints or /var/lib/unbound/root.hints
Logs: journalctl -u unbound
User: unbound (drops privileges after startup)
Install: apt install unbound / dnf install unbound
Control: unbound-control (requires key setup: sudo unbound-control-setup)

Key Operations

Goal	Command
Check config	`sudo unbound-checkconf`
Reload config (no restart)	`sudo systemctl reload unbound` or `sudo unbound-control reload`
Restart service	`sudo systemctl restart unbound`
Flush cache	`sudo unbound-control flush_zone .`
Test resolution	`dig @127.0.0.1 google.com`
Test DNSSEC	`dig @127.0.0.1 dnssec.works` → should resolve; `dig @127.0.0.1 fail.dnssec.works` → should SERVFAIL