Pi-hole is not necessarily incomplete: it filters and caches DNS requests, then usually forwards requests it does not block or already have cached to an upstream resolver. What to add depends on what you mean by “private DNS.” For local recursive resolution instead of relying on one public resolver, Pi-hole documents Unbound. To encrypt the connection from Pi-hole to a chosen upstream resolver, it documents dnscrypt-proxy. They address different privacy concerns and are not interchangeable.
What Pi-hole does—and what it leaves to an upstream resolver
Pi-hole’s FTL DNS service checks requests against blocklists and its cache. When a request is neither blocked nor cached, a standard setup forwards it to one of the upstream DNS services you have configured. That resolver supplies the answer.
As an Amazon Associate I earn from qualifying purchases.
Adding a tool therefore depends on the gap you want to close. Unbound lets Pi-hole resolve names recursively through the DNS hierarchy. dnscrypt-proxy encrypts the connection from Pi-hole to a selected upstream resolver. Neither turns DNS into a system where no party can learn anything about your queries.
Choose based on who you want to receive queries
| Option | Where queries go | Is the Pi-hole-to-resolver link encrypted? | What it is for |
|---|---|---|---|
| Pi-hole with a configured upstream resolver | The selected upstream provider receives queries Pi-hole forwards to it. | Depends on the upstream configuration; ordinary DNS forwarding is not encrypted. | Filtering and caching, with resolution delegated to an upstream service. |
| Pi-hole with Unbound | Unbound contacts the DNS hierarchy: root servers for delegation information, then relevant TLD and authoritative servers. | No. Recursive DNS queries are not encrypted by this setup. | Local recursive resolution rather than sending every forwarded query to one large recursive provider. |
| Pi-hole with dnscrypt-proxy | The selected upstream resolver receives the queries it resolves. | Yes, dnscrypt-proxy encrypts the connection to the chosen upstream using a supported encrypted DNS protocol. | Protecting the Pi-hole-to-upstream connection, including against interception or man-in-the-middle attacks. |
These options can be considered along separate dimensions: the resolver that learns the query, whether transport is encrypted, first-query delay and caching, network support for direct DNS on port 53, and the work involved in setup and maintenance. Unbound changes the resolution path; dnscrypt-proxy protects the path to a selected resolver. Choose according to the concern that matters to you.
#1 Best Overall
What Unbound changes
With Unbound running locally, Pi-hole sends forwarded requests to that local resolver. Unbound follows referrals through the DNS hierarchy to find the authoritative server for the requested name, rather than asking one configured public recursive resolver to perform the whole lookup. Pi-hole’s documented example runs Unbound on the same device as Pi-hole, so it does not require additional hardware.
This distributes queries among the parts of the DNS hierarchy that need them: root servers receive requests about TLD delegation, while authoritative servers receive requests for names they host. It avoids sending every queried name to a single large recursive provider, but it does not hide those queries from the relevant DNS infrastructure or encrypt them.
Rank #2
- Versatile M.2 NVMe Compatibility: This pi rack supports a wide range of M.2 NVMe SSD sizes, including 2230, 2242, and 2280, while adhering to PCIe NVMe Gen2 and Gen3 protocols. This compatibility guarantees high-speed read and write performance, suitable for various demanding applications (Get an extra NVME hat: B0F1MW7DDS)
- Space-Saving Design: This rack mount comes with m.2 NVME SSD adapters has a compact footprint of 100x60mm, this design fits neatly beneath the Raspberry Pi, allowing for easy integration without obstructing GPIO accessibility. This feature is particularly beneficial for attaching heat sinks and POE caps, maximizing efficiency in limited spaces
- Rackmount Efficiency: Designed for optimal space utilization, this rack accommodates up to 4 Raspberry Pi 5 devices and 4 M.2 NVMe SSDs within a standard 19" 1U rack. This configuration not only saves space but also enhances organization in server environments.
- LED Activity Indicators: Equipped with LED indicators, this UCTRONICS for Raspberry Pi 5 Rack provides real-time status updates for M.2 disk activity. These visual cues allow users to monitor drive performance and health at a glance, enhancing usability and troubleshooting.
- Flexible Power Options: This solution supports versatile power management by allowing power supply through the Raspberry Pi's TYPE-C port or directly from the NVMe base. This flexibility ensures reliable operation and simplifies setup, catering to various user needs and preferences.
Latency and caching
Recursive resolution can involve more steps than asking a large resolver with a warm cache. Pi-hole’s Unbound guide, dated September 12, 2026, says a first request for a previously unknown TLD may take up to a second or more, especially with DNSSEC enabled; subsequent requests for domains under that TLD usually complete in less than 0.1 seconds. These are operational figures stated in the guide, not independent measurements of every installation. Pi-hole and Unbound both cache answers to reduce repeated work.
Check whether your network permits direct DNS
Before relying on recursion, verify that the Pi-hole host can reach root servers directly over both UDP and TCP on port 53. An ISP may redirect outbound port 53; a consumer router or filtering product may intercept DNS; and some CG-NAT implementations may drop TCP DNS traffic. These conditions can prevent direct recursion from working as intended.
Pi-hole’s guide provides dig checks against the root server at 198.41.0.4. In the replies, an authoritative-answer flag (aa) without a recursion-available flag (ra) helps indicate that you received a direct response from a root server rather than a recursive answer. Follow the guide’s checks for both UDP and TCP before switching your setup.
Configure Pi-hole to use Unbound
Pi-hole’s documented sample configuration has Unbound listen only on the local loopback address, 127.0.0.1, at port 5335. It enables both UDP and TCP and validates DNSSEC signatures, discarding domains that fail validation as BOGUS. Use the current Pi-hole Unbound guide for the complete installation and configuration file, since the sample setup includes more than the upstream selection.
- Install and configure Unbound using Pi-hole’s guide, including its loopback-only listener and UDP/TCP settings.
- In Pi-hole’s upstream DNS settings, add the custom upstream
127.0.0.1#5335. - For this configuration, untick the other upstream servers so Pi-hole sends forwarded queries to Unbound.
- Make a DNS request and check Pi-hole’s logs. The guide’s verification step is to confirm requests are forwarded to
127.0.0.1#5335.
Use dnscrypt-proxy when encrypted upstream transport is the goal
Recursion and encryption solve different problems. If the concern is that a network path between Pi-hole and an upstream resolver might observe or alter ordinary DNS traffic, dnscrypt-proxy can encrypt that connection. Pi-hole’s guide describes it for DNS over HTTPS (DoH) and other encrypted DNS protocols. Its example selects an upstream server, runs the proxy locally on port 5053, and sets Pi-hole’s upstream to 127.0.0.1#5053.
Encryption does not stop the selected resolver from seeing the queries it handles. It protects the connection to that resolver, not the query from the resolver itself. Pi-hole’s guide provides package-installation instructions for Debian 13 Trixie and Ubuntu 25 Plucky Puffin and later; users on other distributions are directed to the dnscrypt-proxy official wiki. Consult the Pi-hole dnscrypt-proxy guide for its current configuration steps.
Do not start a new setup with the old cloudflared proxy-DNS recipe
Pi-hole’s cloudflared guide warns that the proxy-DNS feature it describes was deprecated in November 2025. It says installations remain supported for 12 months after their release date, updates after February 2, 2026 will no longer work as described, and new installations using that method are not recommended. For encrypted upstream DNS, use a currently documented path such as dnscrypt-proxy instead.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
