Ticket #49264: unbound.conf

# See unbound.conf(5) man page, version 1.5.1.
#

server:
        # verbosity 1 is default.
        
        verbosity: 1

        # Set to "" or 0 to disable. Default is disabled - every N seconds.
        # 86400 = one day
        
        statistics-interval: 86400

        # statistics-cumulative: no

        # extended-statistics: no
        
        num-threads: 2
        
    # interface: 127.0.0.1
    # interface: 10.0.0.8
    # interface: 192.168.1.8
    # interface: ::1    
        interface: 0.0.0.0
        interface: ::0
        
        # dont work on mac
        # interface-automatic: yes

        # port to answer queries from, default 53       
        
        port: 53

        # outgoing-range: 4096

        # outgoing-port-permit: 32768

        # outgoing-port-avoid: "3200-3208"
        
        # default 10
        # outgoing-num-tcp: 10
        
        # default 10
        # incoming-num-tcp: 10

        so-rcvbuf: 2m

        so-sndbuf: 2m

        # so-reuseport: no
        
        # default 4096
        # edns-buffer-size: 4096

        # Default is 4096. 65536 disables it.
        # max-udp-size: 4096
        
        # default 65552
        # msg-buffer-size: 65552

        #  message cache -default is "4Mb". 
        
        msg-cache-size: 4m
        
        msg-cache-slabs: 4

        # num-queries-per-thread: 1024

        # jostle-timeout - Default 200 milliseconds
        
        jostle-timeout: 200
        
        # default 0     
        # delay-close: 0

        # RRset cache default is "4Mb". 
        
        rrset-cache-size: 4m
        
        rrset-cache-slabs: 4
        
        cache-min-ttl: 5
        
        cache-max-ttl: 86400

        # infra-host-ttl: 900

        infra-cache-slabs: 4

        # infra-cache-numhosts: 10000
        
        do-ip4: yes
        
        do-ip6: yes
        
        do-udp: yes
        
        do-tcp: yes

        # tcp-upstream: no

        # do-daemonize: yes
        
        access-control: ::1 allow
        # access-control: 127.0.0.1 allow
        # access-control: fe80::1 allow
        # access-control: 10.0.0.8 allow
        # access-control: 192.168.1.8 allow
        # access-control: ::ffff: allow
        access-control: fd00::/8 allow
        access-control: fe80::/10 allow
        access-control: 127.0.0.0/8 allow
    access-control: 10.0.0.0/8 allow
    access-control: 172.16.0.0/12 allow
    access-control: 192.168.0.0/16 allow
    access-control: 169.254.0.0/16 allow
        
        chroot: "/opt/local/etc/unbound"
        
        username: "unbound"
        
        directory: "/opt/local/etc/unbound"
        
        logfile: "/logs/unbound.log"

        use-syslog: no 
        
        log-time-ascii: yes
        
        log-queries: yes

        # pidfile: "/opt/local/var/run/unbound/unbound.pid"

        # get one from ftp://FTP.INTERNIC.NET/domain/named.cache
        # root-hints: ""
        
        root-hints: "/named.cache"
        
        # hide-identity: yes
        
        # hide-version: yes

        # identity: ""

        # version: ""

        # target-fetch-policy: "3 2 1 0 0"

        # harden-short-bufsize: no

        # harden-large-queries: no
        
        # harden-glue - default is on
        
        harden-glue: yes
        
        # harden-dnssec-stripped - default is on
        
        harden-dnssec-stripped: yes

        # harden-below-nxdomain: no

        # harden-referral-path: no

        # use-caps-for-id: no


        # private-address: 10.0.0.0/8
        # private-address: 172.16.0.0/12
        # private-address: 192.168.0.0/16
        # private-address: 169.254.0.0/16
        # private-address: fd00::/8
        # private-address: fe80::/10

        # private-domain: "example.com"

        # unwanted-reply-threshold: 0

        # do-not-query-address: 127.0.0.1/8
        # do-not-query-address: ::1

        # do-not-query-localhost: yes
        
        # prefetch - default no
        
        prefetch: yes

        # prefetch-key: no

        # rrset-roundrobin: no

        # minimal-responses: no

        # module-config: "validator iterator"

        # auto-trust-anchor-file: "/opt/local/var/run/unbound/root.key"
        
        ## Can be an absolute path outside of chroot/work dir.
        ## pidfile: "/opt/local/var/run/unbound/unbound.pid"    

        # Download http://ftp.isc.org/www/dlv/dlv.isc.org.key
        # dlv-anchor-file: "dlv.isc.org.key"

        # trusted-keys-file: ""
        # /opt/local/var/run/unbound/root.key
        # dont run
        # trusted-keys-file: "/opt/local/var/run/unbound/root.key"

        # Domain is treated as insecure.
        # domain-insecure: "example.com"

        # val-override-date: ""

        # val-bogus-ttl: 60

        # val-sig-skew-min: 3600
        # val-sig-skew-max: 86400
        
        # val-clean-additional - default is yes
        
        val-clean-additional: yes

        # val-permissive-mode: no

        # ignore-cd-flag: no

        # val-log-level: 2

        # val-nsec3-keysize-iterations: "1024 150 2048 500 4096 2500"
        
        # add-holddown: 2592000 # 30 days

        # del-holddown: 2592000 # 30 days

        # keep-missing: 31622400 # 366 days

        # default is "4Mb". 
        # key-cache-size: 4m

        key-cache-slabs: 4

        #  default is "1Mb". 
        # neg-cache-size: 1m
        
        # ads blocked   
        local-zone: "doubleclick.net" redirect
    local-data: "doubleclick.net A 127.0.0.1"
    local-zone: "googlesyndication.com" redirect
    local-data: "googlesyndication.com A 127.0.0.1"
    local-zone: "googleadservices.com" redirect
    local-data: "googleadservices.com A 127.0.0.1"
    local-zone: "google-analytics.com" redirect
    local-data: "google-analytics.com A 127.0.0.1"
    local-zone: "ads.youtube.com" redirect
    local-data: "ads.youtube.com A 127.0.0.1"
    local-zone: "adserver.yahoo.com" redirect
    local-data: "adserver.yahoo.com A 127.0.0.1"
    # local-zone: "cloudfront.net" redirect
    # local-data: "cloudfront.net A 127.0.0.1"
    
    # micorsoft.com
    
    local-zone: "micorsoft.com" redirect
    local-data: "micorsoft.com A 127.0.0.1"

        # unblock-lan-zones: no

        #
        # You can add locally served data with
        # local-zone: "local." static
        # local-data: "mycomputer.local. IN A 192.0.2.51"
        # local-data: 'mytext.local TXT "content of text record"'
        #
        # You can override certain queries with
        # local-data: "adserver.example.com A 127.0.0.1"
        #
        # You can redirect a domain to a fixed address with
        # (this makes example.com, www.example.com, etc, all go to 192.0.2.3)
        # local-zone: "example.com" redirect
        # local-data: "example.com A 192.0.2.3"
        #
        # Shorthand to make PTR records, "IPv4 name" or "IPv6 name".
        # You can also add PTR records using local-data directly, but then
        # you need to do the reverse notation yourself.
        # local-data-ptr: "192.0.2.3 www.example.com"

        # service clients over SSL (on the TCP sockets), with plain DNS inside
        # the SSL stream.  Give the certificate to use and private key.
        # default is "" (disabled).  requires restart to take effect.
        # ssl-service-key: "path/to/privatekeyfile.key"
        # ssl-service-pem: "path/to/publiccertfile.pem"
        # ssl-port: 443

        # ssl-upstream: no

        # DNS64 prefix. Must be specified when DNS64 is use.
        # Enable dns64 in module-config.  Used to synthesize IPv6 from IPv4.
        # dns64-prefix: 64:ff9b::0/96


python:
        # Script file to load
        # python-script: "/opt/local/etc/unbound/ubmodule-tst.py"

# Remote control config section. 

remote-control:

        # control-enable: no

        # what interfaces are listened to for remote control.
        # give 0.0.0.0 and ::0 to listen to all interfaces.
        # control-interface: 127.0.0.1
        # control-interface: ::1

        # port number for remote control operations.
        # control-port: 8953

        # unbound server key file.
        # server-key-file: "/opt/local/etc/unbound/unbound_server.key"

        # unbound server certificate file.
        # server-cert-file: "/opt/local/etc/unbound/unbound_server.pem"

        # unbound-control key file.
        # control-key-file: "/opt/local/etc/unbound/unbound_control.key"

        # unbound-control certificate file.
        # control-cert-file: "/opt/local/etc/unbound/unbound_control.pem"

        # end of file