unbound.conf

## this file is located in /etc/unbound/ directory

server:
                   # If no logfile is specified, syslog is used
                   logfile: "/var/log/unbound/unbound.log"
                   verbosity: 1

                   interface: 127.0.0.1
                   port: 5335
                   do-ip4: yes
                   do-udp: yes
                   do-tcp: yes

                   # May be set to yes if you have IPv6 connectivity
                   do-ip6: no

                   # You want to leave this to no unless you have *native* IPv6. With 6to4 and
                   # Terredo tunnels your web browser should favor IPv4 for the same reasons
                   prefer-ip6: no

                   # Use this only when you downloaded the list of primary root servers!
                   root-hints: "/var/lib/unbound/root.hints"

                   # Trust glue only if it is within the server's authority
                   harden-glue: yes

                   # Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
                   harden-dnssec-stripped: yes

                   # Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
                   # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
                   use-caps-for-id: no

                   # Reduce EDNS reassembly buffer size.
                   # Suggested by the unbound man page to reduce fragmentation reassembly problems
                   edns-buffer-size: 1472

                   # Perform prefetching of close to expired message cache entries
                   # This only applies to domains that have been frequently queried
                   prefetch: yes
         
                   # Ensure kernel buffer is large enough to not lose messages in traffic spikes
                   so-rcvbuf: 1m

                   # Ensure privacy of local IP ranges
                   private-address: 192.168.0.0/16
                   private-address: 169.254.0.0/16
                   private-address: 172.16.0.0/12
                   private-address: 10.0.0.0/8
                   private-address: fd00::/8
                   private-address: fe80::/10

                   # This attempts to reduce latency by serving the outdated record before
                   # updating it instead of the other way around. Alternative is to increase
                   # cache-min-ttl to e.g. 3600.
                   cache-min-ttl: 0
                   serve-expired: yes
                                      
                   # Use about 2x more for rrset cache, total memory use is about 2-2.5x
                   # total cache size. Current setting is way overkill for a small network.
                   # Judging from my used cache size you can get away with 8/16 and still
                   # have lots of room, but I've got the ram and I'm not using it on anything else.
                   # Default is 4m/4m
                   msg-cache-size: 64m
                   rrset-cache-size: 128m

                   include: "/etc/unbound/unbound.conf.d/*.conf"