# BIND vs. Unbound



## obsigna (Aug 14, 2014)

Today I switched my FreeBSD gateway from BIND to Unbound as the recursive caching resolver (no forwarding). Everything is working to my expectations, except that Unbound takes roughly twice as long for a first time resolution than named. For the comparison, both were using the same updated root zone hints. Once a name is in the cache, name resolution results without delay -- of course.

Is the bigger first time delay caused by the DNSSEC validation? Can this be tuned somehow, except by disabling validation?


----------



## Oko (Aug 16, 2014)

No it is not! Something is misconfigured. DNSSEC is not even using root zone hints but root.key file. I have upward of 9 Unbound servers at my work and 2 at home running of OpenBSD 5.6 and response time is instantaneous in spite of DNSSEC and very sophisticated PF rules protecting DNS servers.


----------

