server:
	verbosity: 1
 
	port: 53
	tls-port: 853
	interface-automatic: yes
	interface-automatic-ports: "53 853"
 
	do-ip4: yes
	do-ip6: yes
	prefer-ip4: no
	prefer-ip6: yes
	do-udp: yes
	do-tcp: yes
 
	tls-system-cert: yes
	#tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
	tls-service-key: /etc/letsencrypt/live/example.com/privkey.pem
	tls-service-pem: /etc/letsencrypt/live/example.com/fullchain.pem
 
	use-syslog: yes
	log-time-ascii: yes
	log-queries: no
	log-replies: no
	log-tag-queryreply: yes
	log-local-actions: yes
	log-servfail: yes
 
	# curl -o /etc/unbound/root.hints https://www.internic.net/domain/named.cache
	root-hints: root.hints
 
	hide-identity: yes
	hide-version: yes
	harden-short-bufsize: yes
	harden-large-queries: no
	harden-glue: yes
	harden-dnssec-stripped: yes
	harden-below-nxdomain: yes
	harden-referral-path: no
	harden-algo-downgrade: yes
	qname-minimisation: yes
	qname-minimisation-strict: no
	prefetch: yes
	prefetch-key: yes
	minimal-responses: no
 
	private-address: 10.0.0.0/8
	private-address: 172.16.0.0/12
	private-address: 192.168.0.0/16
	private-address: 169.254.0.0/16
	private-address: fd00::/8
	private-address: fe80::/10
	private-address: 127.0.0.0/8
	private-address: ::ffff:0:0/96
 
	private-domain: fritz.box
	domain-insecure: fritz.box
 
	access-control: 192.168.0.0/16 allow
	access-control: 172.16.0.0/12 allow
	access-control: 10.0.0.0/8 allow
	access-control: fd00::/8 allow
	access-control: fe80::/10 allow
 
forward-zone:
	name: fritz.box.
	forward-addr: fd00::ca0e:14ff:feee:a467
	forward-addr: 10.0.0.1
	forward-no-cache: yes