Repo brief: NLnetLabs/unbound

Generated by RepoPilot · document generated 2026-09-16 · concise human review Evidence snapshot · analyzed 2026-09-16T23:01:12.409Z · commit 18d9a5519eee

Verdict

Mixed — Single-maintainer risk — review before adopting

• Last commit 1d ago
• 5 active contributors
• BSD-3-Clause licensed
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against OpenSSF Scorecard

What it is

Unbound is a validating, recursive, and caching DNS resolver written in C that handles DNS queries with DNSSEC validation and modern protocol features. It's designed as a lean, fast alternative to traditional resolvers like BIND, suitable for deployment as a system resolver or embedded in larger systems. The core capability is authoritative and recursive DNS resolution with security validation built in. Monolithic C application: core recursive resolver logic in libunbound/ (C library), command-line tool in src/, configuration parsing via Yacc grammar files, module system for caching backends (cachedb/redis.c), Python/SWIG bindings for scripting (lib/libunbound.i implied by SWIG files),…

Start here

Open these first:

• daemon/daemon.c — Core DNS resolver daemon loop and initialization; entry point for the resolver's main execution logic.
• daemon/daemon.h — Daemon structure definitions and public interfaces; foundational abstraction for the resolver's state.
• cachedb/cachedb.c — Cache database abstraction layer supporting multiple backends (Redis); critical for performance.
• daemon/remote.c — Remote control interface and management protocol; enables operational monitoring and control.
• configure.ac — Build configuration with platform detection and feature flags; determines compilation across diverse environments.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

git clone https://github.com/NLnetLabs/unbound.git
cd unbound
./configure
make
make install

Dependencies required: C compiler, OpenSSL (with headers), libexpat. For repository builds: flex, bison. Optional: libevent for high-concurrency mode via ./configure --with-libevent.

Daily commands:

After ./configure && make, the resolver is invoked via the unbound command (not visible in file list but standard convention). Configuration via /etc/unbound/unbound.conf (documented in man pages and doc/example.c…

…shortened for this brief.

Key cautions & unknowns

• Single-maintainer risk — top contributor 93% of recent commits
• Build from source requires flex and bison even if the pregenerated parser files exist (Yacc/Lex in file list). OpenSSL version compatibility: changes to OpenSSL API between major versions can require adapts;…
• Published-advisory coverage was unavailable for the captured dependencies.
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.