UNBOUND-HOST(1)

📦
version 1.26.2 · 17 versions
, in arch rolling

💅 UNBOUND-HOST 💅

okay bestie so you're looking at unbound-host from Unbound 1.26.2 — it's section 1 of the manual, it's a DNS lookup utility, and honestly? it's kind of iconic. it uses the Unbound validating resolver to look stuff up, which means it doesn't just answer — it checks whether the answer is legit. queen behavior. 👑

✨ SYNOPSIS ✨

unbound-host [-C configfile] [-vdhr46D] [-c class] [-t type] [-y key]
[-f keyfile] [-F namedkeyfile] hostname

🦋 DESCRIPTION 🦋

so unbound-host uses the Unbound validating resolver to query for the hostname and show you the results. with the -v option it also displays the validation status: secure, insecure, or bogus (which is a security failure, not a vibe). 💀

by default it reads no configuration file whatsoever — like, zero, nothing, it's giving independent main character. it just goes straight for the internet root servers. but if you want config, you can use -C for an unbound config file, or -r to read resolv.conf. your call, babe. 🫶

the available options are:

🎀 OPTIONS 🎀

  • hostname — this is the name being resolved (looked up in the DNS). and plot twist: if you hand it an IPv4 or IPv6 address instead, it does a reverse lookup. slay. 🌈
  • -h — shows the version and the commandline option help. the "help me help you" flag. 💖
  • -v — enables verbose output, and it shows validation results on every single line. let's break down what those mean, because this is important bestie:
    • Secure = the NXDOMAIN (no such domain name), nodata (no such data), or positive data response validated correctly with one of the keys. ✅
    • Insecure = that domain name has no security set up for it. no lock, no key, no problem. 🤷‍♀️
    • Bogus (security failure) = the response failed one or more checks. it's likely wrong, outdated, tampered with, or just broken. 🚩
  • -d — enables debug output to stderr. one -d shows you what the resolver and validator are doing and may tell you what's going on. more times, so -d -d, gives you a lot of output — every packet sent and received. not me reading packet logs for fun 💀
  • -c <class> — specify the class to look up for. default is IN, the internet class. classic. 🌸
  • -t <type> — specify the type of data to look up. the default looks for IPv4, IPv6 and mail handler data — or domain name pointers for reverse queries. 🦋
  • -y <key> — specify a public key to use as a trust anchor. this is the base for a chain of trust that gets built up from the trust anchor to the response, so the response message can be validated. can be given as a DS or DNSKEY record. for example:
-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD"
  • -D — enables DNSSEC validation. reads the root anchor from the default configured root anchor at the default location, /etc/trusted-key.key. 🔐
  • -f <keyfile> — reads keys from a file. every line has a DS or DNSKEY record, in the format as for -y. that's the zone file format — the same as what dig and drill produce. 📄
  • -F <namedkeyfile> — reads keys from a BIND-style named.conf file. only the trusted-key {}; entries are read. nothing else, we're picky. 🙈
  • -C <configfile> — uses the specified unbound.conf to prime libunbound(3). pass it as the first argument if you want to override some options from the config file with further arguments on the commandline. order matters, bestie. ⭐
  • -r — reads /etc/resolv.conf and uses the forward DNS servers from there (those could have been set by DHCP). more info in resolv.conf(5).
⚠️ heads up: this breaks validation if those servers do not support DNSSEC. no cap, be careful.
  • -4 — use solely the IPv4 network for sending packets. 🍓
  • -6 — use solely the IPv6 network for sending packets. 💜

🔥 EXAMPLES 🔥

some examples of use. the keys shown below are fakes, thus a security failure is encountered. (yes, on purpose. it's a demo, not a disaster. 😭)

$ unbound-host www.example.com
$ unbound-host -v -y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" www.example.com
$ unbound-host -v -y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" 192.0.2.153

👑 EXIT CODE 👑

unbound-host exits with status code 1 on error and 0 on no error. and listen — the data may not be available on exit code 0. exit code 1 means the lookup encountered a fatal error. so 0 doesn't automatically mean "we got the goods", it just means nothing exploded. iykyk. 💅

🌈 SEE ALSO 🌈

💖 AUTHOR 💖

the Unbound developers are mentioned in the CREDITS file in the distribution. go give them their flowers, they earned them. 🌸 🫶

1999-2026, NLnet Labs

k bye bestie, that's the whole page — written by the Unbound crew, version 1.26.2, dated Oct 21, 2026. now go resolve something and validate it like the icon you are. 🎀✨💜

📦 where this page comes from