Unbound config for Android Private DNS ad filtering

unbound.conf

server:
    verbosity: 1

    statistics-interval: 86500
    statistics-cumulative: yes
    extended-statistics: no

    num-threads: 3

    interface: 0.0.0.0@53
    interface: ::@53
    interface: 0.0.0.0@853
    interface: ::@853

    outgoing-range: 8192
    incoming-num-tcp: 150
    edns-buffer-size: 4096
    msg-cache-size: 4741543253
    num-queries-per-thread: 4096
    delay-close: 10000
    so-reuseport: yes
    rrset-cache-size: 4741543253
    cache-max-ttl: 86400
    cache-min-ttl: 0
    infra-cache-slabs: 4
    key-cache-slabs: 4
    msg-cache-slabs: 4
    rrset-cache-slabs: 4
    udp-upstream-without-downstream: yes

    tls-service-key: "/etc/ssl/certs/key.pem"
    tls-service-pem: "/etc/ssl/certs/cert.pem"
    tls-port: 853
    tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt

    do-daemonize: no

    access-control: 0.0.0.0/0 allow
    access-control: ::/0 allow

    chroot: "/opt/unbound/etc/unbound"
    username: "_unbound"
    directory: "/opt/unbound/etc/unbound"

    logfile: ""
    use-syslog: no

    log-time-ascii: yes
    log-queries: no
    log-replies: no
    log-local-actions: no
    log-servfail: no

    hide-identity: yes
    hide-version: yes
    hide-trustanchor: yes
    identity: "DNS"
    version: "6.6.6"

    harden-short-bufsize: yes
    harden-large-queries: yes
    harden-glue: yes
    harden-dnssec-stripped: yes
    harden-below-nxdomain: yes
    harden-referral-path: no
    harden-algo-downgrade: no

    use-caps-for-id: no

    qname-minimisation: yes

    aggressive-nsec: yes

    private-address: 10.0.0.0/8
    private-address: 172.16.0.0/12
    private-address: 192.168.0.0/16
    private-address: 169.254.0.0/16
    private-address: fd00::/8
    private-address: fe80::/10
    private-address: ::ffff:0:0/96

    do-not-query-localhost: yes

    prefetch: no
    prefetch-key: no

    rrset-roundrobin: yes

    minimal-responses: yes

    auto-trust-anchor-file: "var/root.key"

    val-clean-additional: yes
    val-log-level: 2
    val-permissive-mode: yes

    serve-expired: no

    neg-cache-size: 4M

    ratelimit: 1000

    include: /opt/unbound/etc/unbound/blocklist.conf
#    include: /opt/unbound/etc/unbound/blacklist.conf
#    include: /opt/unbound/etc/unbound/whitelist.conf

forward-zone:
    name: "."
    forward-tls-upstream: yes
    forward-addr: 2606:4700:4700::1111@853#cloudflare-dns.com
    forward-addr: 1.1.1.1@853#cloudflare-dns.com
    forward-addr: 2606:4700:4700::1001@853#cloudflare-dns.com
    forward-addr: 1.0.0.1@853#cloudflare-dns.com

remote-control:
    control-enable: no