I would like to have an encrypted DNS queries + a DNS Cache + Domain Name System Security Extensions (DNSSEC) .

I used this bash script to install DNSCrypt and I choosed to use dnscrypt.eu servers :

DNSCrypt.eu (no logs)

Server address:
Provider name
Public key

I installed ( apt-get install unbound ) Unbound and my unbound.conf file contains :

# See the unbound.conf(5) man page.
# See /usr/share/doc/unbound/examples/unbound.conf for a commented
# reference config file.

    # The following line will configure unbound to perform cryptographic
    # DNSSEC validation using the root trust anchor.
    auto-trust-anchor-file: "/var/lib/unbound/root.key"
verbosity: 1
num-threads: 4                                                        
 do-ip4: yes
 do-udp: yes
 do-tcp: yes
 access-control: allow                
 do-not-query-localhost: no
 chroot: ""       
 logfile: "/var/log/unbound.log"             
 use-syslog: no 
 hide-identity: yes
 hide-version: yes 
 harden-glue: yes
 harden-dnssec-stripped: yes
 use-caps-for-id: yes       
 private-domain: "localhost"      
 local-zone: "localhost." static
 local-data: "freebox.localhost. IN A"                                              
 local-data-ptr: " freebox.localhost"
  name: "."

Like you see, I added this line to activate DNSSEC :

    # The following line will configure unbound to perform cryptographic
    # DNSSEC validation using the root trust anchor.
    auto-trust-anchor-file: "/var/lib/unbound/root.key" 

Now, when I enter : sudo service unbound start This is the error that I get :

     * Restarting recursive DNS server unbound
[1382606879] unbound[8878:0] error: bind: address already in use
[1382606879] unbound[8878:0] fatal error: could not open ports

My question is of course about the error ! Also, is it useful to use DNSSEC in an ordinary laptop (not a DNS server) or it is just useful for DNS Servers ?

  • 1
    DNSSEC is suppose to protect your DNS requests on the way. Thus one of the endpoint (your client or your trusted recursive dns server) should use DNSSEC. The best is of course on your laptop, as you could trust it. But if you use DNSSEC on your recursive DNS server on your gateway (gateway you trust), you do not need to have it on end clients. – jirib Oct 24 '13 at 10:23
  • DNSSEC assures integrity (non-repudiation), it does not ensure privacy. Privacy depends on trusting random individuals to proxy dns requests over an encrypted channel, i.e., a secure and patched dnscrypt-wrapper setup without logging. – dhchdhd Sep 27 '14 at 7:58

Your dnscrypt proxy already uses port 53. I bet :)

  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post. – Anthon Oct 24 '13 at 10:17
  • "My question is of course about the error !" - obvious. Something is using port 53, or am i wrong? Before starting unbound it would be nice to see netstat output. – jirib Oct 24 '13 at 10:21

Thanks @Jiri Xichtkniha and @Anthon

When typing

sudo lsof -nPi | grep \:53

I can see that bind is also listening on the same port :


I made then a modification on /etc/unbound/unbound.conf by adding this line :


ps : The port number, default 53, on which the server responds to queries.

Another solution is to change the port of Bind from 53 to another.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.