server:
  # See https://www.nlnetlabs.nl/documentation/unbound/unbound.conf/
  # logging
  verbosity: 0
  val-log-level: 2
  use-syslog: no
  
  # performance
  num-threads: 1
  prefetch: yes
  prefetch-key: yes
  key-cache-size: 16m
  key-cache-slabs: 4
  msg-cache-size: 4m
  msg-cache-slabs: 4
  rrset-cache-size: 4m
  rrset-cache-slabs: 4
  cache-min-ttl: 3600
  cache-max-ttl: 9000
  
  # privacy
  rrset-roundrobin: yes
  hide-identity: yes
  hide-version: yes
  
  # security
  root-hints: "/etc/unbound/root.hints"
  trust-anchor-file: "/etc/unbound/root.key"
  harden-below-nxdomain: yes
  harden-referral-path: yes
  harden-algo-downgrade: yes
  # set above to no if there is any problem
  
  # network
  do-ip4: yes
  do-ip6: no
  interface: 127.0.0.1

  # other files
  include: "/etc/unbound/blocks-malicious.conf"
forward-zone:
  name: "."
  forward-addr: 1.1.1.1@853#cloudflare-dns.com
  forward-addr: 1.0.0.1@853#cloudflare-dns.com
  forward-tls-upstream: yes