# See unbound.conf(5) man page, version 1.5.1.
#

server:
	# verbosity 1 is default.
	
	verbosity: 1

	# Set to "" or 0 to disable. Default is disabled - every N seconds.
	# 86400 = one day
	
	statistics-interval: 86400

	# statistics-cumulative: no

	# extended-statistics: no
	
	num-threads: 2
	
    # interface: 127.0.0.1
    # interface: 10.0.0.8
    # interface: 192.168.1.8
    # interface: ::1	
	interface: 0.0.0.0
	interface: ::0
	
	# dont work on mac
	# interface-automatic: yes

	# port to answer queries from, default 53	
	
	port: 53

	# outgoing-range: 4096

	# outgoing-port-permit: 32768

	# outgoing-port-avoid: "3200-3208"
	
	# default 10
	# outgoing-num-tcp: 10
	
	# default 10
	# incoming-num-tcp: 10

	so-rcvbuf: 2m

	so-sndbuf: 2m

	# so-reuseport: no
	
	# default 4096
	# edns-buffer-size: 4096

	# Default is 4096. 65536 disables it.
	# max-udp-size: 4096
	
	# default 65552
	# msg-buffer-size: 65552

	#  message cache -default is "4Mb". 
	
	msg-cache-size: 4m
	
	msg-cache-slabs: 4

	# num-queries-per-thread: 1024

	# jostle-timeout - Default 200 milliseconds
	
	jostle-timeout: 200
	
	# default 0	
	# delay-close: 0

	# RRset cache default is "4Mb". 
	
	rrset-cache-size: 4m
	
	rrset-cache-slabs: 4
	
	cache-min-ttl: 5
	
	cache-max-ttl: 86400

	# infra-host-ttl: 900

	infra-cache-slabs: 4

	# infra-cache-numhosts: 10000
	
	do-ip4: yes
	
	do-ip6: yes
	
	do-udp: yes
	
	do-tcp: yes

	# tcp-upstream: no

	# do-daemonize: yes
	
	access-control: ::1 allow
	# access-control: 127.0.0.1 allow
	# access-control: fe80::1 allow
	# access-control: 10.0.0.8 allow
	# access-control: 192.168.1.8 allow
	# access-control: ::ffff: allow
	access-control: fd00::/8 allow
	access-control: fe80::/10 allow
	access-control: 127.0.0.0/8 allow
    access-control: 10.0.0.0/8 allow
    access-control: 172.16.0.0/12 allow
    access-control: 192.168.0.0/16 allow
    access-control: 169.254.0.0/16 allow
	
	chroot: "/opt/local/etc/unbound"
	
	username: "unbound"
	
	directory: "/opt/local/etc/unbound"
	
	logfile: "/logs/unbound.log"

	use-syslog: no 
	
	log-time-ascii: yes
	
	log-queries: yes

	# pidfile: "/opt/local/var/run/unbound/unbound.pid"

	# get one from ftp://FTP.INTERNIC.NET/domain/named.cache
	# root-hints: ""
	
	root-hints: "/named.cache"
	
	# hide-identity: yes
	
	# hide-version: yes

	# identity: ""

	# version: ""

	# target-fetch-policy: "3 2 1 0 0"

	# harden-short-bufsize: no

	# harden-large-queries: no
	
	# harden-glue - default is on
	
	harden-glue: yes
	
	# harden-dnssec-stripped - default is on
	
	harden-dnssec-stripped: yes

	# harden-below-nxdomain: no

	# harden-referral-path: no

	# use-caps-for-id: no


	# private-address: 10.0.0.0/8
	# private-address: 172.16.0.0/12
	# private-address: 192.168.0.0/16
	# private-address: 169.254.0.0/16
	# private-address: fd00::/8
	# private-address: fe80::/10

	# private-domain: "example.com"

	# unwanted-reply-threshold: 0

	# do-not-query-address: 127.0.0.1/8
	# do-not-query-address: ::1

	# do-not-query-localhost: yes
	
	# prefetch - default no
	
	prefetch: yes

	# prefetch-key: no

	# rrset-roundrobin: no

	# minimal-responses: no

	# module-config: "validator iterator"

	# auto-trust-anchor-file: "/opt/local/var/run/unbound/root.key"
	
	## Can be an absolute path outside of chroot/work dir.
	## pidfile: "/opt/local/var/run/unbound/unbound.pid"	

	# Download http://ftp.isc.org/www/dlv/dlv.isc.org.key
	# dlv-anchor-file: "dlv.isc.org.key"

	# trusted-keys-file: ""
	# /opt/local/var/run/unbound/root.key
	# dont run
	# trusted-keys-file: "/opt/local/var/run/unbound/root.key"

	# Domain is treated as insecure.
	# domain-insecure: "example.com"

	# val-override-date: ""

	# val-bogus-ttl: 60

	# val-sig-skew-min: 3600
	# val-sig-skew-max: 86400
	
	# val-clean-additional - default is yes
	
	val-clean-additional: yes

	# val-permissive-mode: no

	# ignore-cd-flag: no

	# val-log-level: 2

	# val-nsec3-keysize-iterations: "1024 150 2048 500 4096 2500"
	
	# add-holddown: 2592000 # 30 days

	# del-holddown: 2592000 # 30 days

	# keep-missing: 31622400 # 366 days

	# default is "4Mb". 
	# key-cache-size: 4m

	key-cache-slabs: 4

	#  default is "1Mb". 
	# neg-cache-size: 1m
	
	# ads blocked	
	local-zone: "doubleclick.net" redirect
    local-data: "doubleclick.net A 127.0.0.1"
    local-zone: "googlesyndication.com" redirect
    local-data: "googlesyndication.com A 127.0.0.1"
    local-zone: "googleadservices.com" redirect
    local-data: "googleadservices.com A 127.0.0.1"
    local-zone: "google-analytics.com" redirect
    local-data: "google-analytics.com A 127.0.0.1"
    local-zone: "ads.youtube.com" redirect
    local-data: "ads.youtube.com A 127.0.0.1"
    local-zone: "adserver.yahoo.com" redirect
    local-data: "adserver.yahoo.com A 127.0.0.1"
    # local-zone: "cloudfront.net" redirect
    # local-data: "cloudfront.net A 127.0.0.1"
    
    # micorsoft.com
    
    local-zone: "micorsoft.com" redirect
    local-data: "micorsoft.com A 127.0.0.1"

	# unblock-lan-zones: no

	#
	# You can add locally served data with
	# local-zone: "local." static
	# local-data: "mycomputer.local. IN A 192.0.2.51"
	# local-data: 'mytext.local TXT "content of text record"'
	#
	# You can override certain queries with
	# local-data: "adserver.example.com A 127.0.0.1"
	#
	# You can redirect a domain to a fixed address with
	# (this makes example.com, www.example.com, etc, all go to 192.0.2.3)
	# local-zone: "example.com" redirect
	# local-data: "example.com A 192.0.2.3"
	#
	# Shorthand to make PTR records, "IPv4 name" or "IPv6 name".
	# You can also add PTR records using local-data directly, but then
	# you need to do the reverse notation yourself.
	# local-data-ptr: "192.0.2.3 www.example.com"

	# service clients over SSL (on the TCP sockets), with plain DNS inside
	# the SSL stream.  Give the certificate to use and private key.
	# default is "" (disabled).  requires restart to take effect.
	# ssl-service-key: "path/to/privatekeyfile.key"
	# ssl-service-pem: "path/to/publiccertfile.pem"
	# ssl-port: 443

	# ssl-upstream: no

	# DNS64 prefix. Must be specified when DNS64 is use.
	# Enable dns64 in module-config.  Used to synthesize IPv6 from IPv4.
	# dns64-prefix: 64:ff9b::0/96


python:
	# Script file to load
	# python-script: "/opt/local/etc/unbound/ubmodule-tst.py"

# Remote control config section. 

remote-control:

	# control-enable: no

	# what interfaces are listened to for remote control.
	# give 0.0.0.0 and ::0 to listen to all interfaces.
	# control-interface: 127.0.0.1
	# control-interface: ::1

	# port number for remote control operations.
	# control-port: 8953

	# unbound server key file.
	# server-key-file: "/opt/local/etc/unbound/unbound_server.key"

	# unbound server certificate file.
	# server-cert-file: "/opt/local/etc/unbound/unbound_server.pem"

	# unbound-control key file.
	# control-key-file: "/opt/local/etc/unbound/unbound_control.key"

	# unbound-control certificate file.
	# control-cert-file: "/opt/local/etc/unbound/unbound_control.pem"

	# end of file