unbound-host

unbound-host [-C configfile] [-vdhr46D] [-c class] [-t type] [-y key] [-f keyfile] [-F namedkeyfile] hostname

unbound-host performs DNS lookups using the Unbound resolver library (libunbound). It provides DNSSEC validation capabilities, reporting whether responses are secure (cryptographically validated), insecure (no DNSSEC chain of trust for the domain), or bogus (validation failed, possible tampering).If hostname is an IPv4 or IPv6 address, a reverse lookup (PTR record) is performed automatically.By default, the tool reads no configuration file whatsoever and attempts to reach internet root servers directly. The -r option uses resolvers from /etc/resolv.conf, and -C loads a full unbound configuration.DNSSEC validation requires trust anchors. Use -D for automatic root anchor loading, or supply anchors manually with -y, -f, or -F.

-v

Enable verbose output showing DNSSEC validation status on every line (secure, insecure, or bogus).

Enable debug output to stderr. Repeat the flag (-d -d) for increased verbosity including full packet details.

Query specific record type (A, AAAA, MX, TXT, NS, SOA, etc.). Defaults to A, AAAA, and MX for forward lookups, or PTR for reverse lookups.

Query specific DNS class. Defaults to IN (internet). Other values: CH (chaos), HS (hesiod).

Read /etc/resolv.conf and use the forward DNS servers listed there. Note: this may break DNSSEC validation if those servers do not support it.

Read DS or DNSKEY trust anchor records from a file in zone file format (one record per line). Used to supply trust anchors for DNSSEC validation.

Read trust anchor keys from a BIND-style named.conf file. Only trusted-key {} entries are read.

Specify a single trust anchor directly on the command line in DS or DNSKEY record format.

Enable DNSSEC validation using the root anchor from the default location (/usr/share/dns/root.key or /etc/trusted-key.key depending on the system).

Use the specified unbound.conf configuration file to configure the resolver.

Use IPv4 only for sending packets.

Use IPv6 only for sending packets.

Display version and help information.

0

Success (though the queried data may not exist).

A fatal error occurred during the lookup.

Direct root queries may be slow or blocked by firewalls. Using -r with non-DNSSEC-capable servers breaks validation. Trust anchors must be current for DNSSEC to work correctly.

unbound-host is part of the Unbound project by NLnet Labs, providing command-line access to Unbound's validating resolver capabilities. It was designed as a DNSSEC-aware alternative to traditional host and dig commands.

unbound(8), unbound-control(8), dig(1), host(1), drill(1), nslookup(1)