_unbound.conf

server:
	verbosity: 1
	edns-buffer-size: 1472
	rrset-cache-size: 32m
	cache-max-negative-ttl: 10
	chroot: "" # chroot breaks python :(
	username: "nobody"
	harden-glue: yes
	harden-dnssec-stripped: yes
	harden-below-nxdomain: yes
	harden-algo-downgrade: yes
	qname-minimisation: yes
	use-caps-for-id: yes
	private-address: 10.0.0.0/8
	private-address: 172.16.0.0/12
	private-address: 192.168.0.0/16
	private-address: 169.254.0.0/16
	private-address: fd00::/8
	private-address: fe80::/10
	private-address: ::ffff:0:0/96
	private-domain: "plex.tv"
	prefetch: yes
	prefetch-key: yes
	module-config: "python validator iterator"
	auto-trust-anchor-file: "/usr/local/etc/unbound/root.key"
	serve-expired: yes
python:
	python-script: "/usr/local/etc/unbound/no-aaaa.py"
remote-control:
	control-enable: yes
	control-use-cert: no
	control-interface: "/usr/local/etc/unbound/unbound_control.pipe"
forward-zone:
	name: "."
	forward-addr: 199.58.81.218@443
	forward-addr: 2001:470:1c:76d::53@443
	forward-first: yes
	forward-ssl-upstream: yes

no-aaaa.py

def init(id, cfg):
    return True

def deinit(id):
    return True

def inform_super(id, qstate, superqstate, qdata):
    return True

domains = [
    "netflix.com.",
    "nflxso.net.",
    "crt.sh.",
]

def operate(id, event, qstate, qdata):
    if event == MODULE_EVENT_NEW or event == MODULE_EVENT_PASS:
        if qstate.qinfo.qtype != RR_TYPE_AAAA:
            qstate.ext_state[id] = MODULE_WAIT_MODULE
            return True

        for domain in domains:
            if qstate.qinfo.qname_str == domain or qstate.qinfo.qname_str.endswith("." + domain):
                msg = DNSMessage(qstate.qinfo.qname_str, RR_TYPE_A, RR_CLASS_IN, PKT_QR | PKT_RA | PKT_AA)
                if not msg.set_return_msg(qstate):
                    qstate.ext_state[id] = MODULE_ERROR
                    return True
                # We don't need validation, result is valid
                qstate.return_msg.rep.security = 2
                qstate.return_rcode = RCODE_NOERROR
                qstate.ext_state[id] = MODULE_FINISHED
                log_info("no-aaaa: blocking AAAA request for %s" % qstate.qinfo.qname_str)
                return True

        qstate.ext_state[id] = MODULE_WAIT_MODULE
        return True

    if event == MODULE_EVENT_MODDONE:
        qstate.ext_state[id] = MODULE_FINISHED
        return True

    qstate.ext_state[id] = MODULE_ERROR
    return True

log_info("pythonmod: script loaded")