I set up authoritative nameservers at home using unbound, which appears to be considerably easier than configuring BIND, but I still can't say that I fully understand it. DNS (and networking in general) is a bit of a dark art.

You can't go too far wrong with unbound and it is seriously fast and light.

Real men cry into their text editors with BIND and PowerDNS but you do get the whole toy box with these beasties. I've whizzed up many BIND daemons. I once ran a pair of PDNS servers with a MySQL replicated back end.

I currently have an internet exposed and rather locked down PDNS for ACME DNS-01 (Lets Encrypt). The CA consortium are insisting on SSL certs going down to 40 odd day lifetimes within about three years. I look after quite a few SSL certs for my customers. Anyway.

For home labbers, you might consider a Pi Hole (doesn't have to run on a Pi - a VM will do) or, a bit more hard core: https://technitium.com/dns/ (web GUI - yay!) pfSense has Unbound built in and I think OPNSense does too - both are fine choices of router. OpenWRT probably has unbound in it.

When I say, you can't go too far wrong with unbound, I mean it. If it works then it is almost certainly configured correctly.

DNS really is pretty easy. The problem is that Bind zone files are an absolutely godawful interface which makes it seem 10x harder than it actually is. I'm not too upset about it (because it's free software and I figure I can't complain too much), but compare to other DNS solutions and it's night and day how easy they are. For example, running a Windows DNS server (while not something you'd do at home) is dead simple because Microsoft has polished up the user experience. I'm sure some more polished alternatives exist for Linux too, I'm just not familiar enough with what's out there to point to one as an example.

Try NSD. Unlike unbound, NSD is the actual authoritative name server in the project.

I've been running BIND at home since the mid 90's when I had ISDN. The O'Reilly "DNS and BIND" book was my go-to guide when I got started.

I coded my own with dns4j. It's 10 rows of code for only providing my own domains.

The trouble starts when you want to provide ALL domains I guess. I wonder what database would be best for that; just MySQL with int to name table?

The trouble with DNS is that you need a fixed external IP that has port 53 open.

Not easy to get at home cheaply.

> DNS (and networking in general) is a bit of a dark art.

Dynamic routing is fun :)

Same, with ad blocking to boot.

I run unbound at home too.

To me a huge benefit of unbound is that it allows to return whatever you want for wildcards.

Including TLD wildcards.

Seychelles DNS has been hijacked as a whole and only serves malware? Null route the entire .sc.

.ru ? Nah, that won't resolve at my place.

etc.

Then unbound is at ease, even on an old Raspberry Pi, with blocklists made of hundreds of thousands of lines.