Unbound on FreeBSD 15

I switched from BIND 9.20 as caching DNS resolver on my home-made router to Unbound 1.24.1, which comes bundled with FreeBSD 15. Main reason was memory stability.

BIND seemed to consume memory increasingly related to the number of DNS queries:

In contrast, Unbound even returns some memory to the operating system:

The absolute numbers are not comparable, because:

• BIND was configured to download copies of the root, .arpa, .in-addr.arpa, and .ip6.arpa zones via AXFR regularly, while Unbound only uses built-in root nameservers
• BIND was explicitly configured with:
  • 3 local primary DNS zones for localhost and reverse localhost entries
  • 2 local primary DNS zones to overwrite BIND specific version info in the Chaos class
  • 166 local, empty primary DNS zones to ground DNS entries specified by RFCs 1912, 2544, 3879, 4159, 4193, 4291, 5735, 5736, 5737, 6303, and 6598.
• Unbound is fed 1.24 million CNAME records from a RPZ zone file of 36 megs, while BIND used a 18 megs zone file containing 682000 records.

Configuration

I ran /usr/sbin/local-unbound, but modified /var/unbound/unbound.conf just with its official documentation at hand:

server:
	username: unbound
	directory: /var/unbound
	chroot: /var/unbound
	pidfile: /var/run/local_unbound.pid
	auto-trust-anchor-file: /var/unbound/root.key
	so-sndbuf: 0

	module-config: "respip iterator"

	interface-automatic: yes
	access-control: 127.0.0.0/8 allow
	access-control: 192.168.0.0/16 allow

	use-syslog: yes
	log-local-actions: yes
	log-servfail: yes

	prefetch: yes
	num-threads: 4
	outgoing-range: 175

	rrset-cache-size: 256m
	msg-cache-size: 128m

	statistics-interval: 0
	extended-statistics: yes
	statistics-cumulative: yes

	local-zone: 168.192.in-addr.arpa transparent

rpz:
	name: ...
	zonefile: ...

auth-zone:
	name: ...
	zonefile: ...

auth-zone:
	name: 168.192.in-addr.arpa
	zonefile: primary/168.192.in-addr.arpa

include: /var/unbound/control.conf

Then I shutdown BIND and started Unbound:

# service named stop
# sysrc named_enable=NO
# sysrc local_unbound_enable=YES
# service local_unbound start