Self-Hosted DNS Caching Forwarders: dnsmasq vs Knot Resolver vs Unbound (2026)

A DNS caching forwarder sits between your local network and upstream resolvers, storing query results locally to reduce latency, lower bandwidth usage, and improve reliability. Unlike full recursive resolvers that perform the complete DNS resolution chain from root servers downward, caching forwarders delegate recursion to upstream providers while maintaining a local cache of recent answers.

This guide compares three widely deployed DNS caching forwarders — dnsmasq, Knot Resolver, and Unbound — with deployment configurations, performance characteristics, and feature comparisons to help you choose the right solution for your infrastructure.

What Is a DNS Caching Forwarder?

A caching forwarder accepts DNS queries from clients, checks its local cache for a matching answer, and if no cached entry exists, forwards the query to one or more configured upstream resolvers. The response is then cached according to the TTL (time-to-live) value and returned to the client.

The key differences from a recursive resolver:

Caching forwarders excel in environments where upstream resolvers are reliable and fast, but local latency reduction and bandwidth savings are priorities. They are the most common DNS deployment for home networks, small offices, and container environments.

dnsmasq: Lightweight DNS Forwarder and DHCP Server

dnsmasq is the most widely deployed lightweight DNS forwarder, serving over 500 million devices worldwide as the default DNS/DHCP stack in most home routers and Linux distributions.

Key Features

• Combined DNS forwarding and DHCP server in a single binary (~200 KB)
• Local hostname resolution from /etc/hosts and DHCP leases
• PXE/TFTP boot server support
• DNS query filtering with domain-specific upstream servers
• Built-in DNSSEC validation (when compiled with support)
• Supports both IPv4 and IPv6
• Extremely low memory footprint (~5-10 MB)

Installation

Ubuntu/Debian:

1

sudo apt install dnsmasq

Docker Compose:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

version: "3.8"
services:
  dnsmasq:
    image: jpillora/dnsmasq:latest
    container_name: dnsmasq
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "67:67/udp"
    volumes:
      - ./dnsmasq.conf:/etc/dnsmasq.conf:ro
      - ./hosts:/etc/hosts:ro
    cap_add:
      - NET_ADMIN
    networks:
      - dns-net
    environment:
      - DHCP_RANGE=192.168.1.50,192.168.1.150,12h

networks:
  dns-net:
    driver: bridge

Configuration (dnsmasq.conf):

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# Upstream DNS servers
server=8.8.8.8
server=8.8.4.4
server=1.1.1.1

# Cache size (default 150)
cache-size=10000

# Listen on all interfaces
listen-address=0.0.0.0
bind-interfaces

# DNSSEC (optional, requires compiled support)
# dnssec
# trust-anchor=.,19036,8,2,49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5

# Logging
log-queries
log-facility=/var/log/dnsmasq.log

# Domain-specific upstream
server=/internal.example.com/192.168.1.10

Pros and Cons

Pros: Minimal resource usage, combines DNS+DHCP, widely available in package managers, simple configuration syntax, excellent for container environments.

Cons: Single-threaded (limited throughput), no Lua scripting, DNSSEC support depends on compile flags, limited advanced caching policies.

Knot Resolver: High-Performance Caching Resolver with Lua Scripting

Knot Resolver (kresd) is developed by CZ.NIC, the Czech national internet registry. It is built on the Knot DNS library and features a modular architecture with Lua scripting for advanced query processing.

Key Features

• Lua-based policy engine for query/response manipulation
• Modular architecture with loadable C modules
• DNSSEC validation by default
• Support for DNS over TLS (DoT) and DNS over HTTPS (DoH) as upstream
• Cache with configurable policies (serve-stale, prefetch, minimal TTL overrides)
• HTTP REST API for monitoring and cache management
• Multi-threaded for high-throughput environments
• Support for DNS64/NAT64 translation

Installation

Docker Compose:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

version: "3.8"
services:
  knot-resolver:
    image: cznic/knot-resolver:latest
    container_name: knot-resolver
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "8053:8053/tcp"
    volumes:
      - ./kresd.conf:/etc/knot-resolver/kresd.conf:ro
      - kresd-cache:/cache
    networks:
      - dns-net

networks:
  dns-net:
    driver: bridge

volumes:
  kresd-cache:

Configuration (kresd.conf):

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

-- Upstream forwarders
policy.add(policy.suffix(
    policy.FORWARD('8.8.8.8', '8.8.4.4', '1.1.1.1'),
    policy.todnames({'.'})
))

-- Cache configuration
cache.size = 500 * MB

-- DNSSEC validation (enabled by default)
-- trust_anchors.file('/etc/knot-resolver/root.keys')

-- Serve stale data when upstream is unreachable
policy.add(policy.suffix(policy.ROUNDBIN, policy.todnames({'.'})))

-- Prefetch expiring cache entries
prefetch = true

-- Minimal TTL override
policy.add(policy.suffix(policy.MINIMAL_TTL(60), policy.todnames({'.'})))

-- HTTPS monitoring interface
http.config({
    address = {'0.0.0.0'},
    port = 8053
})

Pros and Cons

Pros: Lua scripting enables powerful query manipulation, DNSSEC by default, high-performance multi-threaded design, excellent cache control, built-in monitoring API.

Cons: More complex configuration (Lua-based), steeper learning curve, smaller community than dnsmasq, higher memory usage (~50-200 MB).

Unbound: Validating, Recursive, Caching DNS Resolver

Unbound from NLnet Labs is a validating, recursive, and caching DNS resolver that can operate in forwarding mode. With over 4,500 GitHub stars, it is one of the most trusted open-source DNS implementations.

Key Features

• Full DNSSEC validation with automatic trust anchor management
• Recursive resolution and forwarding modes
• DNS over TLS (DoT) support for both clients and upstream
• QNAME minimization for privacy
• Aggressive NSEC use for cache optimization
• Response Rate Limiting (RRL)
• Local-zone support for split DNS
• Python module for advanced query processing
• Highly configurable cache policies

Installation

Docker Compose:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

version: "3.8"
services:
  unbound:
    image: mvance/unbound:latest
    container_name: unbound
    restart: unless-stopped
    ports:
      - "53:53/tcp"
      - "53:53/udp"
    volumes:
      - ./unbound.conf:/opt/unbound/etc/unbound/unbound.conf:ro
    networks:
      - dns-net

networks:
  dns-net:
    driver: bridge

Configuration (unbound.conf):

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

server:
    # Listen on all interfaces
    interface: 0.0.0.0
    port: 53

    # Forwarding mode (set to "yes" for recursion)
    module-config: "iterator"

    # Upstream forwarders
    forward-zone:
        name: "."
        forward-addr: 8.8.8.8
        forward-addr: 8.8.4.4
        forward-addr: 1.1.1.1
        forward-tls-upstream: yes

    # Cache settings
    msg-cache-size: 50m
    rrset-cache-size: 100m
    cache-max-ttl: 86400
    cache-min-ttl: 60

    # DNSSEC
    auto-trust-anchor-file: "/opt/unbound/etc/unbound/root.key"

    # QNAME minimization
    qname-minimisation: yes

    # Aggressive NSEC
    aggressive-nsec: yes

    # Logging
    verbosity: 1
    log-queries: no
    log-replies: no

    # Access control
    access-control: 192.168.0.0/16 allow
    access-control: 10.0.0.0/8 allow
    access-control: 127.0.0.0/8 allow

Pros and Cons

Pros: Excellent DNSSEC support with automatic trust anchor management, QNAME minimization, aggressive NSEC for cache efficiency, widely audited, strong security track record.

Cons: Heavier resource footprint (~30-100 MB), more complex configuration file, no Lua scripting, single-threaded in forwarding mode.

Comparison Table

Choosing the Right DNS Caching Forwarder

Use dnsmasq when: You need a lightweight DNS forwarder combined with DHCP for a home network, container environment, or small office. Its simplicity and minimal resource usage make it the default choice for most embedded systems and home routers.

Use Knot Resolver when: You need advanced query manipulation through Lua scripting, high-throughput multi-threaded performance, or a caching resolver with fine-grained cache policies. It is ideal for organizations that need to implement custom DNS policies, serve stale data during outages, or integrate with monitoring systems via its HTTP API.

Use Unbound when: DNSSEC validation, QNAME minimization, and privacy features are your top priorities. Unbound’s security-focused design, automatic trust anchor management, and aggressive NSEC support make it the best choice for environments where DNS integrity and privacy matter most.

Why Self-Host Your DNS Caching Forwarder?

Running your own DNS caching forwarder gives you control over your network’s DNS resolution pipeline. Every DNS query from every device on your network passes through this service, making it a critical infrastructure component.

Reduced Latency: Local caching means repeated queries for the same domains are answered in sub-millisecond times instead of the 20-100ms round-trip to upstream resolvers. For networks with dozens of devices making thousands of queries per minute, this adds up to measurable performance improvements.

Bandwidth Savings: Each cached response eliminates an outbound DNS query. In environments with metered or constrained internet connections, reducing DNS traffic to upstream providers conserves bandwidth. A typical caching forwarder reduces external DNS queries by 60-80% after the cache warms up.

Privacy Control: By running your own forwarder, you choose which upstream resolvers handle your queries. You can use privacy-respecting providers, configure DNS over TLS encryption for upstream communication, or even route specific domains through different providers based on your trust model.

Local Name Resolution: All three tools support local hostname resolution, mapping internal device names to IP addresses without requiring a separate DNS server. This is essential for home labs and internal services that need to be reachable by hostname.

For related reading, see our complete DNS resolvers comparison and DNS load balancing guide.

FAQ

What is the difference between a DNS caching forwarder and a recursive resolver?

A caching forwarder delegates DNS resolution to upstream servers, while a recursive resolver performs the full resolution chain from root servers down to authoritative name servers. Forwarders are simpler to configure and lighter on resources, but recursive resolvers provide more control and better privacy since they query authoritative servers directly.

Which DNS caching forwarder uses the least memory?

dnsmasq uses the least memory, typically 5-10 MB in production. This makes it ideal for resource-constrained environments like home routers, Raspberry Pi deployments, and container environments where memory is at a premium.

Does dnsmasq support DNSSEC validation?

dnsmasq can validate DNSSEC when compiled with the --enable-dnssec flag, but this is not enabled in all distribution packages. Knot Resolver and Unbound both enable DNSSEC validation by default with automatic trust anchor management.

Can I use DNS over TLS with these forwarders?

Knot Resolver and Unbound both support DNS over TLS (DoT) for upstream queries. dnsmasq does not natively support DoT, but you can pair it with a DoT-capable stub resolver like stubby to achieve encrypted upstream communication.

How do I measure cache hit rates?

dnsmasq logs cache statistics in syslog when queried with killall -USR1 dnsmasq. Knot Resolver provides cache statistics via its HTTP API on port 8053. Unbound provides unbound-control stats for detailed cache metrics including hit rates, miss rates, and cache sizes.

Can these forwarders block ads and tracking domains?

dnsmasq can block domains using address=/tracking.example.com/ directives in its configuration. Knot Resolver supports blocking through Lua policy scripts. Unbound supports blocking through local-zone declarations. For dedicated ad-blocking, consider pairing these with Pi-hole, AdGuard Home, or Technitium DNS.