dnscrypt.nl unbound config

unbound.conf

server:
	verbosity: 0
	use-syslog: no
	log-queries: no
	log-replies: no
	val-log-level: 0

	log-servfail: yes

	do-daemonize: yes

	num-threads: 1
	
	interface: 127.0.0.1
	interface: ::1
	interface: 10.99.0.11
	interface: 10.10.0.1
	port: 53

	do-ip4: yes
	do-ip6: yes
	do-udp: yes
	do-tcp: yes
	
	so-rcvbuf: 4m
	so-sndbuf: 4m
	
	prefetch: yes
	prefetch-key: yes
	serve-expired: yes
	so-reuseport: yes
	
	username: "_unbound"
	pidfile: "/opt/unbound/etc/unbound/unbound.pid"
	root-hints: "/opt/unbound/etc/unbound/root.hints"
	auto-trust-anchor-file: "/opt/unbound/etc/unbound/var/root.key"
	
	hide-identity: yes
	hide-version: yes
	
	harden-large-queries: yes
	harden-glue: yes
	harden-dnssec-stripped: yes
	harden-referral-path: yes
	minimal-responses: yes

	use-caps-for-id: no  #Pihole compatibility
	edns-buffer-size: 1272  #Pihole compatibility

	access-control: 127.0.0.1 allow
	access-control: ::1 allow
	access-control: 10.99.0.10 allow
	access-control: 10.10.0.0/24 allow

	statistics-interval: 0
	statistics-cumulative: no
	extended-statistics: yes
	
	cache-min-ttl: 1800
	cache-max-ttl: 86400

	outgoing-range: 8192
	num-queries-per-thread: 4096
	delay-close: 10000
	msg-cache-size: 558779050
	msg-cache-slabs: 2
	rrset-cache-size: 558779050
	rrset-cache-slabs: 2
	infra-cache-slabs: 2
	key-cache-slabs: 2
	neg-cache-size: 4M
	
	private-address: 10.0.0.0/8
	private-address: 10.10.0.0/24
	private-address: 172.16.0.0/12
	private-address: 192.168.0.0/16
	private-address: 169.254.0.0/16
	private-address: fd00::/8
	private-address: fe80::/10
	private-address: ::ffff:0:0/96
	
	local-zone: "belkin." static
	local-zone: "corp." static
	local-zone: "domain." static
	local-zone: "example." static
	local-zone: "home." static
	local-zone: "invalid." static
	local-zone: "lan." static
	local-zone: "local." static
	local-zone: "localdomain." static
	local-zone: "test." static
	local-zone: "2.dnscrypt-cert.ns0.dnscrypt.nl." refuse
	local-zone: "localhost." static
	
	local-data: "localhost. 10800 IN NS localhost."
	local-data: "localhost. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
	local-data: "localhost. 10800 IN A 127.0.0.1"
	local-zone: "127.in-addr.arpa." static
	local-data: "127.in-addr.arpa. 10800 IN NS localhost."
	local-data: "127.in-addr.arpa. 10800 IN SOA localhost. nobody.invalid. 2 3600 1200 604800 10800"
	local-data: "1.0.0.127.in-addr.arpa. 10800 IN PTR localhost."
	
	include: "/opt/unbound/etc/unbound/ad-blacklist.conf"	

remote-control:
	control-enable: yes
	control-use-cert: no
	control-interface: 127.0.0.1
	control-interface: ::1
	control-interface: 10.99.0.11 
	control-port: 8953
	server-key-file: "/opt/unbound/etc/unbound/unbound_server.key"
	server-cert-file: "/opt/unbound/etc/unbound/unbound_server.pem"
	control-key-file: "/opt/unbound/etc/unbound/unbound_control.key"
	control-cert-file: "/opt/unbound/etc/unbound/unbound_control.pem"