Networking and Security

OPNsense Dnsmasq vs Unbound DNS: Which One Is Better?

Dnsmasq vs Unbound: Unbound is a recursive, validating resolver; Dnsmasq is a forwarder and DHCP server. Why OPNsense 26 uses both and how to set it up.

By Amjid Ali · · Updated · 5 min read

OPNSense: DNSMasq vs. Unbound DNS – Which One is Better?: SyncBricks cover
In this article
  1. Quick answer
  2. Dnsmasq vs Unbound: the comparison
  3. What changed in OPNsense (25.7 to 26.7)
  4. Recommended setup: Unbound for DNS, Dnsmasq for DHCP
  5. When to make Dnsmasq the primary resolver
  6. Dnsmasq vs Unbound outside OPNsense
  7. My recommendation
  8. Related guides

Unbound is the better DNS resolver; Dnsmasq is the better small-network DHCP server, and on OPNsense in 2026 you should use them together. Unbound is a validating, recursive, caching resolver with DNSSEC, DNS over TLS and built-in blocklists. Dnsmasq is a lightweight DNS forwarder plus DHCP server that registers client host names. Since OPNsense 26.1, the default setup is exactly that: Unbound answers DNS on port 53 and Dnsmasq handles DHCPv4, DHCPv6 and router advertisements.

This post was updated in October 2026 for OPNsense 26.7. The first version treated the two as either/or and said Dnsmasq has no DNSSEC; that was wrong, and OPNsense has since changed its defaults, so the advice below is new.

Quick answer

Your situation Use
DNS for all clients on an OPNsense firewall Unbound (default)
DHCP on a home, lab or small office network Dnsmasq (default since 26.1)
Local host names for DHCP clients (laptop.lan.internal) Dnsmasq registers them, Unbound forwards the local domain to Dnsmasq
Encrypted upstream DNS (DoT) Unbound
DNS ad and malware blocking on the firewall Unbound blocklists
Large or HA DHCP deployments Kea DHCP instead of Dnsmasq

Dnsmasq vs Unbound: the comparison

Feature Unbound Dnsmasq
What it is Validating, recursive, caching DNS resolver DNS forwarder and cache, plus DHCPv4/DHCPv6 and RA
Resolves names itself Yes, from the root servers (or can forward) No, always forwards to an upstream resolver
DNSSEC validation Yes Yes (OPNsense: DNSSEC checkbox)
DNS over TLS upstream Yes, per domain or catch-all No
DHCP server No Yes
Registers DHCP host names in DNS Not from Dnsmasq or Kea leases directly (ISC only) Yes, with "DHCP fqdn"
Built-in blocklists in OPNsense Yes, with sources, categories and per-network policies No
Firewall alias from DNS (IPset) No Yes
Memory and CPU use Higher (bigger cache, recursion) Very low
OPNsense default role DNS resolver since 17.7 DHCP and RA since 26.1

Speed, honestly

Older posts (including mine) said Unbound is faster because it queries the root servers directly. That is not quite right. On a cache hit, both answer in well under a millisecond from the firewall. On a cache miss, a recursive resolver like Unbound has to walk the DNS tree (root, TLD, authoritative server), which can take longer than Dnsmasq forwarding to a big anycast resolver such as Quad9 or Cloudflare that already has the answer cached. What Unbound gives you is independence and privacy: no single upstream sees all of your queries, and DNSSEC is validated on your own box. Unbound's prefetch option also refreshes popular names before they expire, which hides most of the miss penalty in daily use.

What changed in OPNsense (25.7 to 26.7)

  • 25.7: factory reset and console interface assignment switched the default DHCP from ISC to Dnsmasq.
  • 26.1: Dnsmasq became the default for DHCPv4, DHCPv6 and router advertisements out of the box. ISC DHCP moved to a plugin; upgrades install it automatically, fresh installs do not. Unbound gained blocklist source selection.
  • 26.1.8: Dnsmasq ignores DHCP host names of wpad, for CERT VU#598349.
  • ISC DHCP is end of life upstream and gets no security fixes; OPNsense strongly recommends moving to Kea or Dnsmasq.

One limit to know: Dnsmasq cannot do DHCPv6 prefix delegation. If you hand out prefixes to downstream routers, use Kea or another DHCPv6 server for that part.

This follows the layout in the OPNsense documentation.

1. Unbound as the resolver

Services > Unbound DNS > General

  • Enable Unbound: on, Listen Port: 53 (blank also means 53).
  • Enable DNSSEC Support: on.
  • Register DHCP Static Mappings: on, if you use static mappings.

Under Services > Unbound DNS > Advanced, turn on Prefetch Support and Serve Expired Responses for a snappier feel.

Leave Query Forwarding empty to run fully recursive. If you prefer an upstream, add catch-all servers there, or use DNS over TLS with port 853 to a provider such as Quad9 (9.9.9.9, host name dns.quad9.net) or Cloudflare (1.1.1.1, host name cloudflare-dns.com).

2. Dnsmasq for DHCP, DNS moved off port 53

Services > Dnsmasq DNS & DHCP > General

  • Enable: on.
  • Listen port: 53053 (so it does not clash with Unbound). Set 0 instead if you do not want Dnsmasq to answer DNS at all.
  • DHCP fqdn: on, so leases are registered as hostname.yourdomain.
  • Domain: your local domain, for example lan.internal.

Then add a DHCP range for each interface under Services > Dnsmasq DNS & DHCP > DHCP ranges.

3. Forward the local domain from Unbound to Dnsmasq

Services > Unbound DNS > Query Forwarding, add:

  • Domain: lan.internal
  • Server IP: 127.0.0.1
  • Server Port: 53053

If you have reverse lookups for your LAN, add the reverse zone too (for example 1.168.192.in-addr.arpa) pointing at the same server and port.

4. Test from a client

nslookup laptop.lan.internal
nslookup opnsense.org

The first should return the client's DHCP address (answered by Dnsmasq through Unbound), the second a public IP (answered by Unbound). On the firewall itself, Services > Unbound DNS > Log File and Reporting > Unbound DNS show what is being queried.

When to make Dnsmasq the primary resolver

The OPNsense docs also describe the reverse layout: Dnsmasq on port 53, forwarding everything else to Unbound on another port. It is useful if you need Dnsmasq features such as firewall aliases built from DNS answers (IPset) or dynamic IPv6 PTR records. The trade-off is that Unbound statistics and per-client blocklist policies stop being accurate, because every query reaches Unbound from 127.0.0.1. For most networks, keep Unbound in front.

Dnsmasq vs Unbound outside OPNsense

The same split applies on Linux, Pi-hole or a router:

  • Pi-hole uses its own FTL engine (a Dnsmasq fork) as the forwarder and DHCP server. A popular setup is Pi-hole forwarding to a local Unbound on 127.0.0.1#5335 for recursion; see my Pi-hole installation guide.
  • pfSense offers the DNS Resolver (Unbound) and DNS Forwarder (Dnsmasq). pfBlockerNG's DNSBL only works with the Resolver; see pfBlockerNG feeds.
  • OpenWrt ships Dnsmasq by default, with Unbound as an optional package.

My recommendation

On OPNsense 26.x, accept the defaults: Unbound for DNS with DNSSEC and its blocklists, Dnsmasq for DHCP with host name registration, and one Query Forwarding entry to tie them together. Move DHCP to Kea only when you need high availability or prefix delegation.

Frequently asked questions

What is the difference between Dnsmasq and Unbound?+

Unbound is a validating, recursive, caching DNS resolver: it can look up any name itself, starting from the root servers, and check DNSSEC signatures. Dnsmasq is a lightweight DNS forwarder and DHCP server: it caches answers but sends every new query to an upstream resolver, and it hands out IP addresses and registers client host names. They solve different problems, which is why they are often used together.

Should I use Dnsmasq or Unbound on OPNsense?+

Use both, in the roles OPNsense now gives them by default: Unbound as the DNS resolver on port 53 for all clients, and Dnsmasq as the DHCPv4, DHCPv6 and router advertisement service. Since OPNsense 26.1, Dnsmasq is the default DHCP server and ISC DHCP has moved to a plugin. For local host names, let Dnsmasq register leases and have Unbound forward your local domain to it.

Is Unbound faster than Dnsmasq?+

For cached answers both are effectively instant. For uncached names, Unbound in full recursive mode is usually a little slower on the first lookup than Dnsmasq forwarding to a large public resolver, because it has to walk the DNS tree itself; after that it serves from cache. Unbound can also forward to an upstream if you prefer, which makes the speed similar.

Does Dnsmasq support DNSSEC?+

Yes. Dnsmasq can validate DNSSEC, and OPNsense exposes it as a DNSSEC checkbox in the Dnsmasq general settings. What Dnsmasq does not do is DNS over TLS to its upstream servers; for encrypted upstream DNS on OPNsense, use Unbound's DNS over TLS settings.

Can Dnsmasq and Unbound run at the same time on OPNsense?+

Yes, as long as they do not both listen on port 53. The OPNsense documentation's example moves Dnsmasq DNS to 127.0.0.1 port 53053 and adds an Unbound query forwarding entry for the local domain, so Unbound answers clients and asks Dnsmasq only for local DHCP host names. Alternatively set the Dnsmasq DNS port to 0 if you only want it for DHCP.

Which is better for ad blocking, Dnsmasq or Unbound?+

On OPNsense, Unbound. It has an integrated DNS blocklist feature with predefined sources, and since 26.1 it supports choosing blocklist sources and categories, with policies per source network. Dnsmasq has no built-in blocklist management in OPNsense.

Sources

  1. Unbound DNS, OPNsense documentation
  2. Dnsmasq DNS & DHCP, OPNsense documentation
  3. 26.1 Series release notes, OPNsense documentation
  4. 25.7 Series release notes, OPNsense documentation
  5. ISC DHCP (end of life notice), OPNsense documentation
  6. Unbound documentation, NLnet Labs
  7. Dnsmasq, Simon Kelley

Related videos

Video library
  • Networking and Security

    Why No One Shows You OPNsense Diagnostics Secrets (3‑Minute Guide)

    · 2:40 · 524 views

    Watch on YouTube

Keep reading