How to Configure Windows Sandbox Local DNS Server with Unbound via XML in Windows 11

When developing network-resilient software, testing split-horizon DNS environments, or reproducing DNSSEC validation failures, altering DNS configuration on your primary workstation can disrupt host communication and corporate VPN connectivity. Windows Sandbox offers an isolated, disposable Hyper-V testing ground. By mounting Unbound—a high-performance, validating recursive caching DNS resolver—into Windows Sandbox via a .wsb XML file, you can spin up a dedicated local DNS caching server in seconds. This tutorial covers the complete setup.

The Architecture of an Isolated DNS Testing Environment

Windows Sandbox boots with an ephemeral virtual network adapter attached to the Hyper-V NAT virtual switch. By mapping a host directory containing the portable Unbound Windows binaries, configuration files (unbound.conf), and an automated PowerShell provisioning script via <MappedFolders>, the sandbox installs the Unbound Windows service, binds it to 127.0.0.1:53, configures guest DNS resolver settings, and initiates live query logging.

Structuring Host Folders and Assets

Create a dedicated automation directory on your Windows 11 host (for example, C:\SandboxDNS):

C:\SandboxDNS\
├── unbound\
│   ├── unbound.exe
│   ├── unbound.conf
│   └── root.key
├── Start-Unbound.ps1
└── Unbound_Sandbox.wsb

Authoring the Unbound Configuration File

Save the following configuration as C:\SandboxDNS\unbound\unbound.conf:

server:
    verbosity: 1
    interface: 127.0.0.1
    port: 53
    do-ip4: yes
    do-udp: yes
    do-tcp: yes
    
    # Enable DNSSEC validation
    auto-trust-anchor-file: "C:/SandboxAssets/unbound/root.key"
    val-log-level: 2
    
    # Access control
    access-control: 127.0.0.0/8 allow
    
    # Custom test override domain
    local-zone: "staging.local." static
    local-data: "api.staging.local. IN A 10.0.0.99"
    local-data-ptr: "10.0.0.99 api.staging.local"

forward-zone:
    name: "."
    forward-addr: 1.1.1.1
    forward-addr: 8.8.8.8

Authoring the Unbound Provisioning Script

Save the following PowerShell script as C:\SandboxDNS\Start-Unbound.ps1. This script launches Unbound and configures the guest adapter:

# Start-Unbound.ps1 - Automated DNS Provisioning
param (
    [string]$UnboundDir = "C:\SandboxAssets\unbound"
)

Write-Host "Initialising Unbound DNS Resolver inside Windows Sandbox..." -ForegroundColor Cyan

# 1. Start Unbound in background
$UnboundExe = Join-Path $UnboundDir "unbound.exe"
$UnboundConf = Join-Path $UnboundDir "unbound.conf"

$Process = Start-Process $UnboundExe -ArgumentList "-c `"$UnboundConf`"" -PassThru -NoNewWindow
Start-Sleep -Seconds 2

# 2. Configure Sandbox Network Adapter to resolve via Localhost (127.0.0.1)
$Adapter = Get-NetAdapter | Where-Object { $_.Status -eq "Up" } | Select-Object -First 1
Set-DnsClientServerAddress -InterfaceIndex $Adapter.InterfaceIndex -ServerAddresses "127.0.0.1"

# 3. Flush DNS Cache
Clear-DnsClientCache

Write-Host "Local Unbound DNS Server active and resolving on adapter $($Adapter.Name)!" -ForegroundColor Green
Write-Host "Test resolution: Resolve-DnsName api.staging.local" -ForegroundColor Yellow

# Keep session active
Wait-Process -Id $Process.Id

Creating the WSB XML Configuration

Create Unbound_Sandbox.wsb to mount the folder and execute the setup script upon launch:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxDNS</HostFolder>
      <SandboxFolder>C:\SandboxAssets</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\SandboxAssets\Start-Unbound.ps1</Command>
  </LogonCommand>
</Configuration>

Running and Auditing Local DNS Resolution

1. Double-click Unbound_Sandbox.wsb on your Windows 11 host.
2. Windows Sandbox spins up, mounts C:\SandboxDNS, starts Unbound, and sets DNS resolution to 127.0.0.1.
3. Open PowerShell inside the sandbox and resolve your custom test domain:

   Resolve-DnsName api.staging.local

   Output immediately returns 10.0.0.99.
4. Resolve public domains to verify DNSSEC validation caching.
5. Closing the sandbox terminates the resolver and removes all DNS modifications without touching the host machine.