In January I did the thing I had been threatening to do for two years and put a
tiny box on my home network whose only job is to answer the question where do
I find this domain. It runs unbound, it has no upstream resolver, and it has
been quietly humming along in a closet since.
I expected this to be a project about privacy. It turned out to be a project about noticing: how often a single page asks fifty different domains for something, how cheerfully a smart TV phones home at three in the morning, how the modern web is mostly other people’s servers wearing a trench coat.
The setup, briefly
The hardware is unromantic — a small ARM box, a microSD card, a kettle for moral support. The software is three things in a trench coat:
# /etc/unbound/unbound.conf
server:
interface: 0.0.0.0
access-control: 192.168.0.0/16 allow
hide-identity: yes
hide-version: yes
qname-minimisation: yes
prefetch: yesThat’s the whole shape of it. Then a small blocklist for the most egregious telemetry, and a Grafana dashboard I check approximately never.
What changed
The web does not get faster when you run your own DNS. It just gets quieter.
Page loads are within noise of where they were. What I gained was legibility: I can see, on one screen, every domain my house touched in the last hour. That turns out to be a strange and useful kind of attention.
What I’d do differently
- Skip the fancy dashboards on day one. Logs are enough.
- Keep an upstream fallback for the first two weeks; the rabbit holes are deep.
- Tell your roommates. They will be the first ones to notice when DNS goes down.
The whole exercise reminded me that infrastructure is mostly a question of taste under constraint — what to leave in, what to throw out, what to host yourself, what to let drift. Three months in, I’m keeping the box.