Most people stop at Pi-hole, but Unbound is the privacy upgrade your home network actually needs

Pi-hole blocks ads and unwanted domains but still relies on external DNS resolvers like Google, meaning your queries are logged by third parties. Unbound DNS solves this by acting as a local recursive resolver that queries root nameservers directly, distributing requests rather than routing everything through a single provider. Pairing Unbound as Pi-hole's upstream resolver gives you both ad-blocking with a friendly dashboard and genuinely private DNS resolution. Setup involves running Unbound on a separate LXC (e.g., a Debian container in Proxmox), configuring basic settings, and pointing Pi-hole to use it as the upstream server.