New Unbound Settings

server:

  #log-local-actions: no
  #log-queries: yes
  #log-replies: yes
  #log-servfail: no
  #log-time-ascii: yes
  #log-serviced-queries: yes
  #logfile: ""
  #verbosity: 1


  interface: 127.0.0.1
  #interface: ::1

  port: 5335
  ip-freebind: yes


  access-control: 127.0.0.1/32 allow
  #access-control: ::1/128 allow

  #access-control: ::0/0 refuse
  access-control: 0.0.0.0/0 refuse


  num-threads: 2


  rrset-cache-slabs: 2
  msg-cache-slabs: 2
  infra-cache-slabs: 2
  key-cache-slabs: 2


  do-daemonize: no


  do-ip4: yes
  do-ip6: no
  prefer-ip4: no
  prefer-ip6: no
  do-udp: yes
  do-tcp: yes


  do-not-query-localhost: no
  hide-identity: yes
  identity: "DNS"
  hide-http-user-agent: no
  http-user-agent: "DNS"
  hide-version: yes
  harden-glue: yes
  harden-dnssec-stripped: yes
  use-caps-for-id: yes
  harden-algo-downgrade: yes
  harden-below-nxdomain: yes
  harden-large-queries: yes
  harden-short-bufsize: yes
  harden-referral-path: no
  rrset-roundrobin: yes
  answer-cookie: yes
  delay-close: 5000
  deny-any: yes


  minimal-responses: yes
  qname-minimisation: yes
  qname-minimisation-strict: no


  rrset-cache-size: 256m
  msg-cache-size: 128m
  key-cache-size: 34m
  cache-min-ttl: 300
  cache-max-ttl: 86400
  cache-max-negative-ttl: 900
  infra-cache-numhosts: 100000
  infra-cache-min-rtt: 25
  infra-cache-max-rtt: 60000
  neg-cache-size: 8m


  serve-expired: yes
  serve-expired-ttl: 86400
  serve-expired-ttl-reset: no
  serve-expired-reply-ttl: 60
  serve-expired-client-timeout: 0
  prefetch: yes
  prefetch-key: yes


  edns-buffer-size: 1232
  max-udp-size: 1232
  http-query-buffer-size: 8m
  http-response-buffer-size: 8m


  so-rcvbuf: 8m
  so-sndbuf: 8m


  incoming-num-tcp: 128
  outgoing-num-tcp: 128


  so-reuseport: yes
  aggressive-nsec: yes


  ratelimit: 1000
  ip-ratelimit: 1000
  http-max-streams: 150


  outgoing-range: 2048
  num-queries-per-thread: 1024


  infra-host-ttl: 7200
  infra-cache-min-rtt: 25
  infra-keep-probing: no
  delay-close: 10000
  jostle-timeout: 200
  fast-server-permil: 900
  fast-server-num: 3
  max-query-restarts: 11


  target-fetch-policy: "3 2 1 1 1"


  auto-trust-anchor-file: "/var/lib/unbound/root.key"
  hide-trustanchor: yes
  trust-anchor-signaling: yes
  val-clean-additional: yes
  val-permissive-mode: no


  unwanted-reply-threshold: 10000


  root-hints: "/var/lib/unbound/root.hints"


  module-config: "validator cachedb iterator"


  private-address: 10.0.0.0/8
  private-address: 172.16.0.0/12
  private-address: 192.168.0.0/16
  private-address: 169.254.0.0/16
  private-address: fd00::/8
  private-address: fe80::/10

  private-address: 192.0.2.0/24
  private-address: 198.51.100.0/24
  private-address: 203.0.113.0/24
  private-address: 255.255.255.255/32
  private-address: 2001:db8::/32


  domain-insecure: "in-addr.arpa."
  domain-insecure: "ip6.arpa."
  domain-insecure: "home.arpa."


auth-zone:
    name: "."
    primary: 192.33.4.12          # 10ms
    primary: 198.97.190.53        # 10ms
    primary: 192.5.5.241          # 16ms
    primary: 198.41.0.4           # 17ms
    primary: 192.203.230.10       # 18ms
    #primary: 202.12.27.33         # 289ms
    #primary: 192.58.128.30        # 25ms
    #primary: 170.247.170.2        # 56ms
    #primary: 192.0.32.132         # 155ms
    #primary: 199.7.91.13          # 21ms
    #primary: 192.112.36.4         # TIMEOUT
    #primary: 192.36.148.17        # 293ms
    #primary: 193.0.14.129         # 35ms
    #primary: 199.7.83.42          # 45ms
    #primary: 192.0.47.132         # 94ms

    #primary: 2001:503:ba3e::2:30  # 17ms
    #primary: 2801:1b8:10::b       # 54ms
    #primary: 2001:500:2::c        # 10ms
    #primary: 2001:500:2d::d       # 20ms
    #primary: 2001:500:a8::e       # 16ms
    #primary: 2001:500:2f::f       # 16ms
    #primary: 2001:500:12::d0d     # 71ms
    #primary: 2001:500:1::53       # 10ms
    #primary: 2001:7fe::53         # 121ms
    #primary: 2001:503:c27::2:30   # 24ms
    #primary: 2001:7fd::1          # 21ms
    #primary: 2001:500:9f::42      # 44ms
    #primary: 2001:dc3::35         # 289ms
    #primary: 2620:0:2d0:202::132  # 90ms
    #primary: 2620:0:2830:202::132 # 93ms

    fallback-enabled: yes
    for-downstream: no
    for-upstream: yes
    zonemd-check: yes
    zonefile: "/var/lib/unbound/root.zone"


cachedb:
    backend: "redis"
    redis-server-host: 127.0.0.1
    redis-server-port: 6379
    redis-logical-db: 0
    redis-timeout: 100
    redis-expire-records: yes


remote-control:
  control-enable: yes
  control-interface: 127.0.0.1
  control-port: 8953
  server-key-file: "/etc/unbound/unbound_server.key"
  server-cert-file: "/etc/unbound/unbound_server.pem"
  control-key-file: "/etc/unbound/unbound_control.key"
  control-cert-file: "/etc/unbound/unbound_control.pem"