Setting up Unbound

Meant to sit behind Pi-hole as its upstream resolver, not to be queried by devices directly.

1
Run the container
A well-maintained community image handles the root hints and sane defaults automatically, nothing to configure for a basic recursive resolver. Give it a different port than Pi-hole if running on the same machine.
```
services:
  unbound:
    image: mvance/unbound:latest
    container_name: unbound
    restart: unless-stopped
    ports:
      - "5353:53/tcp"
      - "5353:53/udp"
    volumes:
      - ./unbound:/opt/unbound/etc/unbound
```
2
Point Pi-hole at it
In Pi-hole's Settings → DNS, uncheck every public upstream (Cloudflare, Google, whatever's checked by default) and add a custom upstream: this container's IP address and the port set above.
3
Verify it's actually resolving recursively
A query against this resolver directly should return a real answer without ever touching a public DNS provider.
```
dig @<this-machine-ip> -p 5353 example.com
```

Run the container