Unbound

Unbound is a validating, recursive and caching DNS resolver from NLnet Labs, designed to be fast and lean while incorporating modern features based on open standards.

Validating is the important word in that description. Unbound performs DNSSEC validation itself rather than trusting an upstream resolver to have done it, which is what actually protects against cache poisoning and spoofed answers. A resolver that forwards to someone else's validating server inherits that server's trustworthiness along with the entire network path to it.

Being lean is a deliberate security decision as much as a performance one. A recursive resolver processes data from servers all over the internet, much of it operated by people you have no reason to trust, so a smaller codebase means fewer places for a parsing bug to become a compromise. That reasoning is why NLnet Labs keeps recursion in Unbound and authoritative service in NSD as two separate programs.

The project is widely deployed as the default resolver in several operating systems and appliances, and supports modern transports and features including DNS over TLS, DNS over HTTPS, query minimisation for privacy, access control lists and local zone overrides. It is distributed under a BSD licence with a Python module and a C library for embedding, and NLnet Labs offers commercial support agreements alongside a public community forum.