2026-08-19 16:49:00

OpenBSD domain name servers

I carried for a long time a few misconceptions about OpenBSD's domain name servers.

OpenBSD name servers come in three flavors :

1. Local workstation, roaming but validating domain name server → unwind(8) → localhost
2. Local network, static, caching and validating → unbound(8) → local network
3. Internet daemon, authoritative for publishing DNS zones → nsd(8) → internet. Remember that if you search your domain name from inside your DNS zone network you can break the internet. That's the story behind why bind is not used anymore : it was both caching and authoritative so could be cache-poisoned remotely. Anyway nsd comes after that notion so maybe it's safer.

All three are included in OpenBSD base which makes it the perfect toolkit for DNS too.

My use case was limited : I thought I could use unbound(8) for roaming networks on a local workstation and it did not work very well, had to restart unbound once in a while.