Reading the man pages of OpenBSD gives me

unwind - validating DNS resolver


unbound - Unbound DNS validating resolver 1.11.0

which begs the question - what is the difference between these programs, and which should I prefer?

  • It surely depends what you want it to do. Have you looked at the summary documentation for each? Does one of them do something you need that the other doesn't? Nov 1, 2020 at 9:51

1 Answer 1


The DNS client libraries linked into your applications softwares talk to a proxy DNS server to do all of the work. Proxy DNS servers come in two kinds: resolving proxy DNS servers do all of the work of query resolution themselves, and forwarding proxy DNS servers simply send the same queries from their back ends out to other proxy DNS servers.

This is essentially the difference between unbound and unwind.

  • unbound is a resolving proxy DNS server, that is configured with a set of content DNS servers to start from, and that issues all of the back-end queries necessary to perform all of the grunt work of query resolution, combining what is returned to it in order to return the final full answer on its front end.

    unbound is the conventional form of resolving proxy DNS server, for machines with consistent and stable connections to Internet.
  • unwind is a forwarding proxy DNS server, that is configured with a set of forwardee proxy DNS servers to forward on to, and rules about when to switch to and from using the proxy DNS servers provided by SLAAC and DHCP.

    unwind is a forwarder for machines with inconsistent and unstable connections to Internet, where query resolution is done either:
    • by a resolving proxy DNS server running on a machine elsewhere (on the LAN, or externally at a third party such as IBM/Quad9 or Cloudflare), or
    • by an ISP-provided resolving proxy DNS server when one is behind a captive portal and has not yet logged in.

In a not-logged-in ISP's captive network, a conventional resolving proxy DNS server is unable to reach the public content DNS servers on Internet and thus does not work; unless it is explicitly configured with overrides for the particular domain names used by the ISP's captive portal, which is easy to do for specific ISPs one by one, but hard to automate in the general case.

One can even use both in conjunction, unwind listening on, handling when to switch from captive to normal mode, and configured to forward to unbound, in its turn listening on (say), and doing query resolution locally on the same machine.

Further reading

  • great answer... which is better in conjunction with a VPN? (there are a couple network maps for consideration like captive, non captive, captive with local and non captive with public) or some such
    – Richard
    Nov 7, 2021 at 17:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .