UNBOUND-CONTROL(8) Unbound UNBOUND-CONTROL(8) (NAME) unbound-control - Unbound (SYNOPSIS) unbound-control [-hq] [-c cfgfile] [-s server] command (DESCRIPTION) unbound-control DNS unbound(8) . TLS Unbound . (OPTIONS) : -h . -c . /etc/unbound/unbound.conf . -s IPv4 IPv6 . . -q . (COMMANDS) : start . unbound(8) . unbound PATH . -c . stop . . reload . (cache) . reload_keep_cache RRset () . . fast_reload [+dpv] . (threads) . . . . . : . fast_reload . Unbound fast_reload . (zones) ( RPZ) . : forwards stubs views authority zones RPZ zones local zones. access-control interface-action tcp-connection-limit. define-tag . : insecure-lan-zones domain-insecure trust-anchor-file trust-anchor trusted-keys-file auto-trust-anchor-file edns-client-string ipset log-identity infra-cache-numhosts msg-cache-size rrset-cache-size key-cache-size ratelimit-size neg-cache-size num-queries-per-thread jostle-timeout use-caps-for-id unwanted-reply-threshold tls-use-sni outgoing-tcp-mss ip-dscp max-reuse-tcp-queries tcp-reuse-timeout tcp-auth-query-timeout delay-close iter-scrub-promiscuous tls-service-key tls-service-pem. interface outgoing-interface remote control outgoing-port-permit outgoing-port-avoid msg-buffer-size *-slabs statistics-interval . dnstap : dnstap-log-resolver-query-messages dnstap-log-resolver-response-messages dnstap-log-client-query-messages dnstap-log-client-response-messages dnstap-log-forwarder-query-messages dnstap-log-forwarder-response-messages. : dnstap-enable dnstap-bidirectional dnstap-socket-path dnstap-ip dnstap-tls dnstap-tls-server-name dnstap-tls-cert-bundle dnstap-tls-client-key-file dnstap-tls-client-cert-file. dnstap-send-identity dnstap-send-version dnstap-identity dnstap-version +p . +v . +vv . 'reload' . +p . TTL . . . . . . nopause (+p) fast_reload nopause : val-bogus-ttl val-override-date val-sig-skew-min val-sig-skew-max val-max-restart val-nsec3-keysize-iterations target-fetch-policy outbound-msg-retry max-sent-count max-query-restarts do-not-query-address do-not-query-localhost private-address private-domain caps-exempt nat64-prefix do-nat64 infra-host-ttl infra-keep-probing ratelimit ip-ratelimit ip-ratelimit-cookie wait-limit-netblock wait-limit-cookie-netblock ratelimit-below-domain ratelimit-for-domain. +d ( ). flush_requestlist . . . define-tag +d . . +d . IP IP IP . . +d . verbosity number (verbosity) . verbosity: unbound.conf(5) . ( ) . log_reopen ( ). (logrotate) . syslog syslog ( chroot ). stats . statistics-cumulative: . [name]: [value] . stats_noreset . stats . status . ( ) . local_zone name type . local-zone . . local_zone_remove name . . . local_data RR data... ( ). local-data: (transparent) . local_data_remove name (RR) . . NXDOMAIN ( ) (empty nonterminal) ( ) NOERROR nodata . . local_zones (stdin) unbound-control. . . local_zones_remove unbound-control. . . local_datas unbound-control. (RR) . . local_datas_remove unbound-control. . . dump_cache . . Unbound . load_cache . dump_cache . . . Unbound . cache_lookup [+t] names RRset . . . subnetcache . +t TLD . 'com' '.' . lookup name . flush [+c] name . A AAAA NS SOA CNAME DNAME MX PTR SRV NAPTR SVCB HTTPS . flush_type flush_zone . +c cachedb cachedb . flush_type [+c] name type . +c cachedb cachedb . flush_zone [+c] name . RRset . . ( serve-expired ). +c cachedb cachedb . flush_bogus [+c] (bogus) . +c cachedb cachedb . flush_negative [+c] . nxdomain nodata servfail . ( ) DNSSEC (iterator) rrset . +c cachedb cachedb . flush_stats . flush_requestlist . . . . ( ) . dump_requestlist . . . . . . flush_infra all|IP all (infra) . IP . EDNS (lameness) . dump_infra . set_option opt: val . . ':' . . set_option libunbound Unbound . : statistics-interval statistics-cumulative do-not-query-localhost harden-short-bufsize harden-large-queries harden-glue harden-dnssec-stripped harden-below-nxdomain harden-referral-path prefetch prefetch-key log-queries hide-identity hide-version identity version val-log-level val-log-squelch ignore-cd-flag add-holddown del-holddown keep-missing tcp-upstream ssl-upstream max-udp-size ratelimit ip-ratelimit cache-max-ttl cache-min-ttl cache-max-negative-ttl. get_option opt . ':' . . "" . 'error ...' ( ). . set_option . . list_stubs list_forwards list_local_zones list_local_data . list_stubs (stub zones) . . (root hints) . list_forwards (forward zones) . . list_insecure domain-insecure. list_local_zones . . list_local_data (RR) . . insecure_add zone domain-insecure unbound.conf. Unbound ( flush_zone ) . insecure_remove zone domain-insecure . forward_add [+it] zone addr ... Unbound . +i domain-insecure ( DNSSEC ). addr IP4 IP6 forward-zone unbound.conf. +t TLS forward-tls-upstream: yes. forward_remove [+i] zone Unbound . +i domain-insecure . stub_add [+ipt] zone addr ... Unbound . +i domain-insecure . +p prime notprime . addr IP4 IP6 stub-zone: unbound.conf. +t TLS stub-tls-upstream: yes. stub_remove [+i] zone Unbound . +i domain-insecure . forward [off | addr ... ] (forwarding). . DHCP . . forward-zone "." . . off . off . DNSSEC DHCP . . IPv4 IPv6 . . '@port' ( (DNS) ). "." . . . ratelimit_list [+a] (ratelimit) . (qps) qps . +a qps . ( ) . ip_ratelimit_list [+a] IP . qps qps . +a IP qps . IP . list_auth_zones (auth zones) . . RPZ . auth_zone_reload zone ( RPZ) . . . Unbound for-upstream: yes flush_zone zone . auth_zone_transfer zone ( RPZ) (master). ( SOA). . rpz_enable zone RPZ . rpz_disable zone RPZ. view_list_local_zones view list_local_zones (view) . view_local_zone view name type local_zone . view_local_zone_remove view name local_zone_remove . view_list_local_data view list_local_data . view_local_data view RR data... local_data . view_local_data_remove view name local_data_remove . view_local_datas_remove view local_data . local_datas_remove . view_local_datas view local_data . local_datas . add_cookie_secret secret (cookie secret). secret . active staging . Active DNS DNS active staging . print_cookie_secrets . secret active . active secret staging staging . (roll) anycast: staging anycast . DNS activate_cookie_secret . active drop_cookie_secret . cookie-secret-file server . (""). drop_cookie_secret staging. activate_cookie_secret staging active active staging. print_cookie_secrets . (EXIT CODE) unbound-control . (SET UP) (self-signed) . unbound-control-setup -d . unbound-control . unbound.conf (root) : sudo -u unbound unbound-control-setup unbound.conf . . root control-enable unbound.conf . (STATISTIC COUNTERS) stats stats_noreset : threadX.num.queries . threadX.num.queries_ip_ratelimited IP . threadX.num.queries_cookie_valid DNS . threadX.num.queries_cookie_client DNS . threadX.num.queries_cookie_invalid DNS . threadX.num.queries_discard_timeout (discard-timeout) . threadX.num.queries_replyaddr_limit replyaddr . threadX.num.queries_wait_limit wait-limit . threadX.num.cachehits . threadX.num.cachemiss (recursive) . threadX.num.dnscrypt.crypted dnscrypt . threadX.num.dnscrypt.cert dnscrypt . threadX.num.dnscrypt.cleartext dnscrypt . threadX.num.dnscrypt.malformed dnscrypt. threadX.num.dns_error_reports DNS . threadX.num.prefetch . cachehits . recursivereplies ( ) cachemiss . threadX.num.expired . threadX.num.queries_timed_out UDP . threadX.query.queue_time_us.max . sock-queue-timeout . threadX.num.recursivereplies . (timeout) threadX.num.cachemiss . threadX.requestlist.avg . threadX.requestlist.max . threadX.requestlist.overwritten . . jostle-timeout . . threadX.requestlist.exceeded . . . ( jostle-timeout ) . threadX.requestlist.current.all ( priming glue). threadX.requestlist.current.user . threadX.requestlist.current.replies . . threadX.recursion.time.avg . . threadX.recursion.time.median . . ( ) . . threadX.tcpusage TCP . . incoming-num-tcp . total.num.queries . total.num.queries_ip_ratelimited . total.num.queries_cookie_valid . total.num.queries_cookie_client . total.num.queries_cookie_invalid . total.num.queries_discard_timeout . total.num.queries_replyaddr_limit . total.num.queries_wait_limit . total.num.cachehits . total.num.cachemiss . total.num.dnscrypt.crypted . total.num.dnscrypt.cert . total.num.dnscrypt.cleartext . total.num.dnscrypt.malformed . total.num.dns_error_reports . total.num.prefetch . total.num.expired . total.num.queries_timed_out . total.query.queue_time_us.max . total.num.recursivereplies . total.requestlist.avg . total.requestlist.max requestlist.max . total.requestlist.overwritten . total.requestlist.exceeded . total.requestlist.current.all . total.requestlist.current.user . total.requestlist.current.replies . total.recursion.time.median . total.tcpusage . time.now ( ). time.up (uptime) . time.elapsed . (EXTENDED STATISTICS) mem.cache.rrset RRset. mem.cache.message (message). mem.cache.dnscrypt_shared_secret dnscrypt. mem.cache.dnscrypt_nonce nonce dnscrypt. mem.mod.iterator (iterator). mem.mod.validator (validator). . mem.streamwait TCP TLS. . mem.http.query_buffer HTTP/2. DNS () . mem.http.response_buffer HTTP/2. DNS . mem.quic QUIC. . histogram...to.. . . . (bucket) . num.query.type.A A . . num.query.type.other . num.query.class.IN IN () . ( CH CHAOS ) NONE ANY . num.query.class.other . num.query.opcode.QUERY (opcode) QUERY . UPDATE ... . num.query.tcp TCP Unbound . num.query.tcpout Unbound TCP . num.query.udpout Unbound UDP . num.query.tls TLS Unbound . num.query.tcp TLS TCP . num.query.tls.resume TLS TLS Unbound TLS . num.query.https HTTPS Unbound . num.query.tcp num.query.tls . num.query.quic QUIC Unbound . num.query.tls TLS . num.query.ipv6 IPv6 Unbound . num.query.flags.RD RD . QR AA TC RA Z AD CD . QR AA TC . num.query.edns.present EDNS OPT . num.query.edns.DO EDNS OPT DO (DNSSEC OK) . num.query.edns.present . num.query.ratelimited . num.query.dnscrypt.shared_secret.cachemiss dnscrypt . (hitrate) . num.query.dnscrypt.replay dnscrypt nonce nonce (replay) . num.answer.rcode.NXDOMAIN ( ) NXDOMAIN . . num.answer.rcode.nodata nodata . NOERROR ( NOERROR/NODATA ). num.answer.rcode.NOERROR . AAAA A AAAA . num.answer.secure . . AD AD ( DO AD ). num.answer.bogus (bogus) . SERVFAIL . num.rrset.bogus RRset . RRset . num.valops . RRSIG . RRSIG ( ) Unbound . unwanted.queries . unwanted.replies . (spoofing) . UDP . ( ) . msg.cache.count ( DNS) . rrset.cache.count RRset rrset. rrset . infra.cache.count . IP . key.cache.count . DNSSEC . msg.cache.max_collisions (hash table) . . ( ) . rrset.cache.max_collisions rrset. ( ) . dnscrypt_shared_secret.cache.count . / . CPU Unbound dnscrypt . dnscrypt_nonce.cache.count nonce . (replay) dnscrypt . nonce / . QPS * replay window replay window . num.query.authzone.up auth-zone . ( fallback) . num.query.authzone.down auth-zone . num.query.aggressive.NOERROR NSEC NODATA . . num.query.aggressive.NXDOMAIN NSEC NXDOMAIN . num.query.subnet EDNS . num.query.subnet_cache edns . cachemiss edns client subnet . num.query.cachedb cachedb . num.rpz.action. RPZ RPZ. : nxdomain nodata passthru drop tcp-only local-data disabled cname-override. (FILES) /etc/unbound/unbound.conf Unbound. /etc/unbound (unbound_server.key unbound_control.key) (unbound_server.pem unbound_control.pem). (SEE ALSO) unbound.conf(5) unbound(8). (AUTHORS) Unbound CREDITS . (COPYRIGHT) 1999-2026, NLnet Labs 1.26.0 August 4, 2026 UNBOUND-CONTROL(8)