I set up authoritative nameservers at home using unbound, which appears to be considerably easier than configuring BIND, but I still can't say that I fully understand it. DNS (and networking in general) is a bit of a dark art.
replies(8):
Dynamic routing is fun :)
Real men cry into their text editors with BIND and PowerDNS but you do get the whole toy box with these beasties. I've whizzed up many BIND daemons. I once ran a pair of PDNS servers with a MySQL replicated back end.
I currently have an internet exposed and rather locked down PDNS for ACME DNS-01 (Lets Encrypt). The CA consortium are insisting on SSL certs going down to 40 odd day lifetimes within about three years. I look after quite a few SSL certs for my customers. Anyway.
For home labbers, you might consider a Pi Hole (doesn't have to run on a Pi - a VM will do) or, a bit more hard core: https://technitium.com/dns/ (web GUI - yay!) pfSense has Unbound built in and I think OPNSense does too - both are fine choices of router. OpenWRT probably has unbound in it.
When I say, you can't go too far wrong with unbound, I mean it. If it works then it is almost certainly configured correctly.
The sheer luxury of two B channels at 64kBps each and if you were cunning, the D channel at 16k (I wasn't cunning and didn't bother)! Yay, double phone charges if you raised the second channel. That was a BRI. A PRI was lots of channels (30) and an even more eye watering bill.
A customer dumped their BRI that was acting as a backup to SIP n that about six months ago. That's the last one I know of.
Its easy to feed an RBL to unbound to do pi-hole type work, I use pf to transparently redirect all external DNS requests to my local unbound server but I get the bind automation around things like DNSSEC, DHCP ddns and ACME cert renewals.
I'm surprised this isn't a more common stack.
To me a huge benefit of unbound is that it allows to return whatever you want for wildcards.
Including TLD wildcards.
Seychelles DNS has been hijacked as a whole and only serves malware? Null route the entire .sc.
.ru ? Nah, that won't resolve at my place.
etc.
Then unbound is at ease, even on an old Raspberry Pi, with blocklists made of hundreds of thousands of lines.
The trouble starts when you want to provide ALL domains I guess. I wonder what database would be best for that; just MySQL with int to name table?
The trouble with DNS is that you need a fixed external IP that has port 53 open.
Not easy to get at home cheaply.
That said! I haven't used AdGuard Home in a very long time, might be time for me to revisit.
I really must get around to looking into opnsense again. I look after 50 odd pfSense boxes (about half on Netgate gear) across the UK but I am a believer in choice and I remember when opensense sort of split from pfSense. Its great to see the project thriving.
When you deploy a well respected alternative to your ISP provided equipment and get it to work, you generally get it right. They (pfSense, opnsense, openwrt and all the rest) will not do an insecure config out of the box. You do have to try quite hard to get it wrong!
Adguard, pfBlocker, pi-hole and co. all largely do a similar job and that is keeping your devices away from the seamier parts of the internet and the seamier sides of the internet away from your network. They are not perfect but are really good at it.
Think steel bound three inch thick front door, with really good hinges and a lock that would give a professional a hard time, rather than PVC or wooden panel with a mortice lock. Do keep an eye on the windows though ... 8)
Keep it and everything else reasonably up to date and you are probably golden.
We were sadly not past expressions like that in say the 70s or 80s but by the 90s, that phrase was definitely considered ironic (in the modern sense). Back then irony was merely one metallic mouth feel, along with steely, coppery and brassic.