UNBOUND.CONF(5) Unbound UNBOUND.CONF(5) (NAME) unbound.conf - Unbound 1.26.0. (SYNOPSIS) unbound.conf (DESCRIPTION) unbound.conf unbound(8) . unbound-checkconf(8) unbound.conf . (FILE FORMAT) . . # . . (:) ( ). . (EXAMPLE) . /etc/unbound/unbound.conf : $ unbound -c /etc/unbound/unbound.conf : $ kill `cat /run/unbound.pid` example.conf . # unbound.conf(5) config file for unbound(8). server: directory: "/etc/unbound" username: unbound # unbound chroot . # ( BSD devfs(8) ): # mount --bind -n /dev/urandom /etc/unbound/dev/urandom # mount --bind -n /dev/log /etc/unbound/dev/log chroot: "/etc/unbound" # logfile: "/etc/unbound/unbound.log" # . pidfile: "/run/unbound.pid" # verbosity: 1 # . # . interface: 0.0.0.0 interface: ::0 access-control: 10.0.0.0/8 allow access-control: 2001:db8::/64 allow (SECTION CLAUSES) : server: . remote-control: unbound-control(8) . stub-zone: . forward-zone: DNS . auth-zone: . view: . access-control-view interface-view . python: python. dynlib: dynlib Unbound . dnscrypt: DNSCrypt. cachedb: cachedb Redis Redis. dnstap: dnstap DNS. rpz: DNS . respip . ( ) . server: . (INCLUDING FILES) include: . . . chroot chroot/ include directory: dir . (Wildcards) glob(7) . include-toplevel: . ( ) . (SERVER OPTIONS) server: . verbosity: . Level 0 . Level 1 . Level 2 . Level 3 . Level 4 . Level 5 (Cache Misses) . . unbound(8) unbound-control(8) . : 1 statistics-interval: . 0 "" . requestlist ( 0 ). . : 0 () statistics-cumulative: Unbound . : no extended-statistics: unbound-control(8) . unbound-control(8) . . : no statistics-inhibit-zero: 0 unbound-control(8) . ( NOERROR FORMERR SERVFAIL NXDOMAIN NOTIMPL REFUSED) RPZ . : yes num-threads: . 1 . : 1 port: . : 53 interface: . . . localhost . IP IP . (kill -HUP) . @port ( ) ( port) . ip-address: interface ( nsd.conf(5)). interface-automatic: ( ) UDP . ip-transparent ip-transparent Unbound () . . : no interface-automatic-ports: "" interface-automatic . . . HTTPS DNS-over-TLS . : "" outgoing-interface: . . . () . interface outgoing-interface . . IPv6 IPv6 UDP . IPv6 Unbound (non-local binds) ( ). outgoing-interface IPv6 IPv6 . IPv6 prefer-ip6: yes . freebind ip6 : ip -6 addr add mynetblock/64 dev lo && \ ip -6 route add local mynetblock/64 dev lo outgoing-range: . . 1 . . . libevent . ( ) num-queries-per-thread . : 4096 (libevent) / 960 (minievent) / 48 (windows) outgoing-port-permit: Unbound . . . 1024 IANA . "low-high" . outgoing-port-permit outgoing-port-avoid . IANA 1024 . outgoing-port-avoid: Unbound . Unbound . IPv4 IPv6 . 1024 IANA . "low-high" . outgoing-num-tcp: TCP . 0 do-tcp: no TCP . . : 10 incoming-num-tcp: TCP . 0 do-tcp: no TCP . . : 10 edns-buffer-size: EDNS. UDP . msg-buffer-size ( TCP UDP) . . 512 MTU TCP ( outgoing-num-tcp ). : 1232 ( DNS Flag Day 2020) max-udp-size: UDP ( TCP ). 65536 UDP . 512 4096 . : 1232 ( edns-buffer-size) stream-wait-size: . 'k' 'm' 'g' (1024*1024 ). TCP TLS . ( ) TCP . : 4m msg-buffer-size: . 65552 64 DNS . . DNS SERVFAIL . : 65552 msg-cache-size: . 'k' 'm' 'g' (1024*1024 ). : 4m msg-cache-slabs: . . 2 . () . 2 . : () num-queries-per-thread: . (jostle-timeout ) . . . : 2048 (libevent) / 512 (minievent) / 24 (windows) jostle-timeout: . . 50% 50% . (DoS) . qps : (num-queries-per-thread / 2) / (average time for such long queries) qps qps : (num-queries-per-thread / 2) / (jostle-timeout in whole seconds) qps per thread (2048/2)*5 = 5120 qps. : 200 delay-close: UDP . () 1500 . IP . : 0 () udp-connect: connect(2) UDP ICMP . : yes unknown-server-time-limit: . 1128. . : 376 discard-timeout: . . . UDP . serve-expired-client-timeout . 1900 . 0 . : 1900 wait-limit: IP . IP . . 0 . : 1000 wait-limit-cookie: IP DNS . wait-limit . 0 . : 10000 wait-limit-netblock: . wait-limit . . . -1 . loopback -1 . loopback 127.0.0.0/8 ::1/128 -1 . : () wait-limit-cookie-netblock: DNS . wait-limit-cookie . -1 . loopback 127.0.0.0/8 ::1/128 -1 . : () so-rcvbuf: 0 SO_RCVBUF 53 UDP . ( netstat -su ). "4m" . Unbound (root) sysctl net.core.rmem_max . BSD kern.ipc.maxsockbuf /etc/sysctl.conf . OpenBSD . Solaris ndd -set /dev/udp udp_max_buf 8388608. : 0 ( ) so-sndbuf: 0 SO_SNDBUF 53 UDP . : send: resource temporarily unavailable netstat -su . 0 . "8m" . ( ARP NDP) . Unbound sysctl net.core.wmem_max . BSD Solaris so-rcvbuf . : 4m so-reuseport: yes SO_REUSEPORT . . >= 3.9 . FreeBSD OSX . ( ) ( 3) . (4.4.x) . : yes ip-transparent: yes IP_TRANSPARENT Unbound . (bind). IP failover . interface-automatic Unbound () . Unbound (root) . FreeBSD IP_BINDANY OpenBSD SO_BINDANY . : no ip-freebind: yes IP_FREEBIND Unbound . IP IP . ip-transparent . : no ip-dscp: (DSCP) (DS) IP. Type-Of-Service IPv4 IPv6 . rrset-cache-size: RRset. 'k' 'm' 'g' (1024*1024 ). : 4m rrset-cache-slabs: RRset. . 2 . () . 2 . : () cache-max-ttl: (TTL) RRset . TTL . ( ) TTL . TTL . : 86400 (1 ) cache-min-ttl: (TTL) RRset . . . : 0 () cache-max-negative-ttl: SOA . NXDOMAIN NODATA . : 3600 cache-min-negative-ttl: SOA . cache-min-ttl . TTL 1 . NXDOMAIN NODATA . : 0 () infra-host-ttl: . EDNS . : 900 infra-cache-slabs: . . 2 . () . 2 . : () infra-cache-numhosts: . : 10000 infra-cache-min-rtt: . . : 50 infra-cache-max-rtt: . : 120000 (2 ) infra-keep-probing: . infra-host-ttl . : no define-tag: "" local-zone access-control . ("") . do-ip4: IPv4 . : yes do-ip6: IPv6 . IPv6 IPv6 . IPv6 DNS DNS IPv4 (A) IPv6 (AAAA) . : yes prefer-ip4: IPv4 DNS . IPv6 /64 /64 IPv4 IPv4 . : no prefer-ip6: IPv6 DNS . : no do-udp: UDP . : yes do-tcp: TCP . : yes tcp-mss: (MSS) TCP . MSS ( 1220) MTU . MSS (TCP_MAXSEG). MSS MTU . outgoing-tcp-mss: (MSS) TCP ( Unbound ). MSS ( 1220) MTU . MSS (TCP_MAXSEG). MSS MTU Unbound . tcp-idle-timeout: Unbound TCP . Unbound . TCP 50% 1% 35% 0.2% 20% 0 . 200 . edns-tcp-keepalive edns-tcp-keepalive-timeout . : 30000 (30 ) tcp-reuse-timeout: Unbound TCP . : 60000 (60 ) max-reuse-tcp-queries: TCP . : 200 tcp-auth-query-timeout: TCP (auth). : 3000 (3 ) edns-tcp-keepalive: EDNS TCP Keepalive . : no edns-tcp-keepalive-timeout: edns-tcp-keepalive tcp-idle-timeout . EDNS TCP Keepalive Unbound . : 120000 (2 ) sock-queue-timeout: UDP . 3 . ( Unbound ). . FreeBSD . : 0 () tcp-upstream: TCP . . no TCP (stub) forward-tcp-upstream stub-tcp-upstream . : no udp-upstream-without-downstream: UDP do-udp: no . TLS UDP UDP . : no ( ) tls-upstream: TLS . . TLS DNS TCP . ( tls-service-key ). tls-cert-bundle tls-win-cert tls-system-cert CA . TLS TLS forward-tls-upstream . stub-tls-upstream. tls-upstream forward-tls-upstream stub-tls-upstream yes . : no ssl-upstream: tls-upstream. . tls-service-key: DNS-over-TLS DNS-over-HTTPS TCP tls-port https-port . TLS tls-service-pem tls-service-key . chroot ( ). ( tls-service-pem) (reload) (fast_reload) . ( ) . tls-port https-port DNS TCP . NOTE: DNS-over-HTTPS Unbound libnghttp2 . : "" () ssl-service-key: tls-service-key. tls-service-pem: pem TLS. : "" () ssl-service-pem: tls-service-pem. tls-port: TCP TLS . @number TLS . : 853 ssl-port: tls-port. tls-cert-bundle: null "" . /etc/pki/tls/certs/ca-bundle.crt. . auth-zone urls DNS-over-TLS. chroot . : "" () ssl-cert-bundle: tls-cert-bundle. tls-win-cert: . . . tls-cert-bundle . . : no tls-system-cert: tls-win-cert . . tls-additional-port: tls-additional-port @port DNS-over-TLS . . tls-session-ticket-keys: "" 80 TLS Unbound . TLS . TLS . . . : dd if=/dev/random bs=1 count=80 of=ticket.dat 16 . 32 AES 32 HMAC . : "" tls-ciphers: (ciphers) TLS . "" . : "" tls-ciphersuites: (ciphersuites) TLS . TLS 1.3 . "" . : "" tls-use-sni: SNI TLS . NOTE: . : yes tls-protocols: "" TLS . TLSv1.2 TLSv1.3. ("") . NOTE: . : "TLSv1.2 TLSv1.3" pad-responses: TLS EDNS pad-responses-block-size . : yes pad-responses-block-size: TLS . . : 468 pad-queries: TLS pad-queries-block-size . : yes pad-queries-block-size: TLS . : 128 https-port: DNS-over-HTTPS . @number HTTPS . : 443 http-endpoint: (endpoint) HTTP DNS-over-HTTPS . : /dns-query http-max-streams: SETTINGS_MAX_CONCURRENT_STREAMS SETTINGS HTTP/2 DNS-over-HTTPS . : 100 http-query-buffer-size: HTTP/2 . DNS () . RST_STREAM . 'k' 'm' 'g' (1024*1024 ). : 4m http-response-buffer-size: HTTP/2 . DNS . RST_STREAM . 'k' 'm' 'g' (1024*1024 ). : 4m http-nodelay: TCP_NODELAY DNS-over-HTTPS . . : yes http-notls-downstream: TLS DNS-over-HTTP . (back end) . : no proxy-protocol-port: proxy-protocol-port @port PROXYv2 . ACL ( / ). ( ) ACL DNSTAP RPZ IP . PROXYv2 UDP TCP/TLS . DoH DoQ DNSCrypt PROXYv2 . . quic-port: DNS-over-QUIC . @number QUIC . QUIC UDP . 0 QUIC QUIC . QUIC . : 853 quic-size: QUIC . 'k' 'm' 'g' (1024*1024 ). (connection refused) . . : 8m use-systemd: systemd . : no do-daemonize: Unbound . Unbound systemd no . : yes tcp-connection-limit: TCP . . . : () access-control: IP . DNS . IP . IPv4 IPv6 size/ . refuse . access-control . deny refuse allow allow_setrd allow_snoop allow_cookie deny_non_local refuse_non_local . deny . refuse DNS rcode REFUSED . allow . ( ) . . allow local-data . Unbound . . . allow_setrd (RD) . RFC 1034 RD . DNS DNS (stub) RD DNS . allow_snoop . . allow_snoop (cache snooping) ( ). ( ). allow_snoop . allow_cookie UDP DNS RFC 7873 RFC 9018 answer-cookie . UDP DNS DNS BADCOOKIE DNS DNS . allow_cookie (stateful) DNS answer-cookie . UDP DNS REFUSED TC TCP . deny_non_local deny_non_local local-data . . refuse_non_local refuse_non_local local-data . REFUSED . localhost ( IP 127.0.0.0/8 loopback) . refused . DNS ( ) . access-control-tag: "" access-control. . define-tag . ("") . access-control-tag access-control allow . access-control-tag-action: . access-control-tag local-zone-tag <<>> define-tag . access-control-tag-data: "" . access-control-view: . interface-action: access-control . access-control . refuse . localhost ( IP 127.0.0.0/8 loopback) access-control . interface-*: loopback "access-control: 127.0.0.0/8 allow" . NOTE: interface access-control*: interface-*: . interface-tag: <"list of tags"> access-control-tag . NOTE: interface access-control*: interface-*: . interface-tag-action: access-control-tag-action . NOTE: interface access-control*: interface-*: . interface-tag-data: <"resource record string"> access-control-tag-data . NOTE: interface access-control*: interface-*: . interface-view: access-control-view . NOTE: interface access-control*: interface-*: . chroot: chroot ( ) . chroot . ( roothints ) : . . pidfile . chroot . pidfile /var/run/unbound.pid chroot /var/unbound . Unbound pidfile chroot . Unbound /dev/urandom ( ) chroot . chroot(2) . "" chroot(2) . : /etc/unbound username: (bind) . username: "" . ( HUP) . . : unbound directory: . "%EXECUTABLE%" unbound.exe . server: directory: include . : /etc/unbound logfile: "" stderr . : [seconds since 1970] unbound[pid:tid]: type: message. use-syslog no . SIGHUP ( ) . : "" () use-syslog: Unbound syslog(3) syslogd . LOG_DAEMON "unbound" . use-syslog: yes logfile . : yes log-identity: "" "unbound" . Unbound . : "" log-time-ascii: UTC ASCII . syslog syslog . : no ( 1970 ) log-time-iso: ISO8601 log-time-ascii: yes . : no log-queries: IP . ( ) . ( ) '?' . : no log-replies: IP . ( ) . ( ) '?' . : no log-tag-queryreply: 'query' 'reply' log-queries log-replies . . : no ( ) log-destaddr: log-replies . UDP TCP . : no log-local-actions: . local-zone type inform . : no log-servfail: SERVFAIL . . : no log-thread-id: ( ) Unbound . . : no pidfile: . "/run/unbound.pid" . : kill -HUP `cat /run/unbound.pid` kill -TERM `cat /run/unbound.pid` . : /run/unbound.pid root-hints: (root hints) . IN. . . : "" hide-identity: 'id.server' 'hostname.bind' (REFUSED). : no identity: . "" . : "" hide-version: 'version.server' 'version.bind' (REFUSED). : no version: . "" . : "" hide-http-user-agent: HTTP User-Agent . HTTP . http-user-agent . : no http-user-agent: HTTP User-Agent HTTP . "" . : "" nsid: NSID EDNS nsid EDNS . 'ascii_' ASCII. : () hide-trustanchor: 'trustanchor.unbound' (REFUSED). : no target-fetch-policy: <"list of numbers"> Unbound . . Unbound . 1- . 0 . . ("") . "0 0 0 0 0" BIND 9 "-1 -1 -1 -1 -1" BIND 8 . : "3 2 1 0 0" harden-short-bufsize: EDNS . : yes ( RFC 6891) harden-large-queries: . no TSIG EDNS . : no harden-glue: glue . : yes harden-unverified-glue: glue . glue () . glue . : no harden-dnssec-stripped: DNSSEC . DNSSEC ( DNSKEY ) . ( ) DNSSEC . . : yes harden-below-nxdomain: RFC 8020 ( "NXDOMAIN: There Really Is Nothing Underneath") NXDOMAIN NXDOMAIN . DNSSEC NOERROR . ( IP ) NXDOMAIN . NXDOMAIN DNSSEC DNSSEC . NOTE: NXDOMAIN NSEC3 optout . : yes harden-referral-path: . . DNSSEC NS . off RFC . . target-fetch-policy . : no harden-algo-downgrade: DS . DS RFC 4509 (Unbound ) DS() . no . RFC 6840 . RFC 6840 . RFC 6840 DNSSEC . WARNING: DNSSEC RFC 6840 / . : no harden-unknown-additional: . no . yes . : no use-caps-for-id: 0x20 . . dns-0x20 . : no caps-exempt: caps-for-id . 0x20 . . caps-whitelist: caps-exempt. qname-minimisation: . QNAME QTYPE A . NOERROR QNAME QTYPE NXDOMAIN DNSSEC. : yes qname-minimisation-strict: QNAME . QNAME . . . qname-minimisation . : no aggressive-nsec: NSEC NSEC DNSSEC NXDOMAIN NXDOMAIN . . : yes private-address: IPv4 IPv6 . . DNS . DNSSEC . DNS . A AAAA SVCB HTTPS . SVCB HTTPS svcparams ipv4hint ipv6hint . local-data private-domain . . IP RFC 1918 . 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fd00::/8 fe80::/10 RFC . 127.0.0.0/8 . ::ffff:0:0/96 IPv6 IPv4 . private-domain: . . : () unwanted-reply-threshold: . . rrset . 10 . 0.0.0.0/8 '::' do-not-query-address . localhost . do-not-query-localhost ( ) . : 0 () do-not-query-address: IP . IPv4 IPv6 . num/ 10.2.3.4/24 2001::11/64. : () do-not-query-localhost: yes localhost do-not-query-address IPv6 ::1 IPv4 127.0.0.1/8. no localhost . : yes prefetch: yes 10 TTL . 10 . : no prefetch-key: yes DNSKEY DS . . . 0 . : no deny-any: yes ANY . Unbound ANY . ANY DNSSEC . : no rrset-roundrobin: yes Unbound RRSet ( ). : yes minimal-responses: yes Unbound / . TCP . yes RFC DNS . . prefetch . : yes disable-dnssec-lame-check: yes DNSSEC . RRSIG DNSSEC RRSIG . RRSIG DNSSEC . : no module-config: "" ("") . respip validator iterator ( ). NOTE: . "iterator" . "validator iterator" DNSSEC . NOTE: trust-anchors . respip RPZ . . subnetcache iterator . python . dynlib . : "validator iterator" trust-anchor-file: . DS DNSKEY . DNS . : "" ( ) auto-trust-anchor-file: RFC 5011 . . trust-anchor-file . Unbound . ( ) chroot ( ). : "" ( ) trust-anchor: "" DS DNSKEY . trust-anchor-file . dig(1) drill(1) . "" . TTL . IN . : () trusted-keys-file: . . trust-anchor-file . BIND-9 trusted-keys { name flag proto algo "key"; }; . . : "" ( ) trust-anchor-signaling: RFC 8145 . : yes root-key-sentinel: . : yes domain-insecure: DNSSEC . DS DS . . ( ). () . DS . : () val-override-date: WARNING: ! RRSIG RRSIG . . 1- . : 0 () val-sig-skew-min: . 10% ( - ) . 3600 (1 ) . . : 3600 (1 ) val-sig-skew-max: . 10% ( - ) . 86400 (24 ) . . . : 86400 (24 ) val-max-restart: . : 5 val-bogus-ttl: . . TTL . . : 60 val-clean-additional: . . . : yes val-log-level: . . 1 . . dig drill . 2 Unbound . : 0 () val-permissive-mode: . ( ) SERVFAIL . . AD . . : no ignore-cd-flag: Unbound CD . CD ( ) . (w2008) CD DNSSEC Unbound DNSSEC . : no disable-edns-do: EDNS DO . DNSSEC Unbound . DNSSEC DNSSEC . DO EDNS . Unbound DNSSEC ( validator ) DNSSEC Unbound . : no serve-expired: Unbound TTL serve-expired-reply-ttl . serve-expired-client-timeout . : no serve-expired-ttl: . 0 . serve-expired . RFC 8767 86400 (1 ) 259200 (3 ) . 86400 . : 86400 serve-expired-ttl-reset: TTL serve-expired-ttl . . : no serve-expired-reply-ttl: TTL . serve-expired-client-timeout 30 ( RFC 8767). TTL . TTL . TTL TTL . : 30 serve-expired-client-timeout: . serve-stale RFC 8767 . 0 . : 1800 serve-original-ttl: Unbound TTL TTL . Unbound . TTL Unbound . NOTE: TTL Unbound TTL . NOTE: cache-min-ttl cache-max-ttl . : no val-nsec3-keysize-iterations: <"list of values"> . NSEC3 . . "1024 65535" NSEC3 . NOTE: . : "1024 150 2048 150 4096 150" zonemd-permissive-mode: ZONEMD servfail . . : no add-holddown: auto-trust-anchor-file RFC 5011 . : 2592000 (30 RFC) del-holddown: auto-trust-anchor-file RFC 5011 . : 2592000 (30 RFC) keep-missing: auto-trust-anchor-file RFC 5011 . ( 5011) . 0 RFC . : 31622400 (366 ) permit-small-holddown: 5011 . : no key-cache-size: . 'k' 'm' 'g' (1024*1024 ). : 4m key-cache-slabs: . . 2 . () . 2 . : () neg-cache-size: . 'k' 'm' 'g' (1024*1024 ). : 1m unblock-lan-zones: . Unbound dns 'lan' . localhost 127.0.0.1 ::1 . Unbound DNS ( DHCP) ( RFC) DNS . : no insecure-lan-zones: . unblock-lan-zones . : no local-zone: . local-data . deny refuse static transparent redirect nodefault typetransparent inform inform_deny inform_redirect always_transparent block_a block_aaaa block_a_wdata block_aaaa_wdata always_refuse always_nxdomain always_null noview . . local-data . DNS . IN . CNAME/DNAME DNSSEC stub-zone . stub-zone unbound . forward-zone unbound . auth-zone auth-zone . forward-zone auth-zone . local-zone local-data rpz RPZ . deny . . refuse rcode REFUSED . . static . NODATA NXDOMAIN . SOA local-data . transparent local-data . . local-data localdata NOERROR NODATA . local-zone local-data . typetransparent . . transparent A NODATA AAAA . redirect . . . : local-zone: "example.com." redirect local-data: "example.com. A 127.0.0.1" www.example.com www.foo.example.com example.com . CNAME local-data : local-zone: "example.com." redirect local-data: "example.com. CNAME www.example.org." CNAME . CNAME local-zone CNAME . CNAME redirect . DNS . DNS . CNAME local-zone redirect local-zone inform_redirect . CNAME local-zone redirect : example.com. CNAME *.foo.net. www.example.com. CNAME www.example.com.foo.net. . inform transparent. IP (portnumber@) . : timestamp, unbound-pid, info: zonename inform IP@port queryname type class. . inform_deny deny inform. . inform_redirect redirect inform. . always_transparent transparent . block_a transparent A . A NODATA . IPv6 IPv4 . block_aaaa transparent block_a AAAA . AAAA NODATA . IPv4 IPv6 . block_a_wdata block_a . transparent . A NODATA . block_aaaa_wdata block_aaaa . transparent . AAAA NODATA . always_refuse refuse . DS . DNSSEC . DS . always_nxdomain static NXDOMAIN . always_nodata static NODATA . always_deny deny . always_null 0.0.0.0 ::0 . redirect A AAAA. . . noview . view-first no . view-first . . nodefault AS112 . . nodefault . nodefault transparent . localhost 127.0.0.1 ::1 home.arpa resolver.arpa service.arpa onion test invalid AS112. AS112 DNS IP . NXDOMAIN ( ) . local-zone nodefault . . localhost IPv4 IPv6 . NS SOA DNS . : local-zone: "localhost." redirect local-data: "localhost. 10800 IN NS localhost." local-data: "localhost. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" local-data: "localhost. 10800 IN A 127.0.0.1" local-data: "localhost. 10800 IN AAAA ::1" reverse IPv4 loopback : local-zone: "127.in-addr.arpa." static local-data: "127.in-addr.arpa. 10800 IN NS localhost." local-data: "127.in-addr.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" local-data: "1.0.0.127.in-addr.arpa. 10800 IN PTR localhost." reverse IPv6 loopback : local-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." static local-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN NS localhost." local-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" local-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN PTR localhost." home.arpa (RFC 8375) : local-zone: "home.arpa." static local-data: "home.arpa. 10800 IN NS localhost." local-data: "home.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" resolver.arpa (RFC 9462) : local-zone: "resolver.arpa." static local-data: "resolver.arpa. 10800 IN NS localhost." local-data: "resolver.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" service.arpa (draft-ietf-dnssd-srp-25) : local-zone: "service.arpa." static local-data: "service.arpa. 10800 IN NS localhost." local-data: "service.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" onion (RFC 7686) : local-zone: "onion." static local-data: "onion. 10800 IN NS localhost." local-data: "onion. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" test (RFC 6761) : local-zone: "test." static local-data: "test. 10800 IN NS localhost." local-data: "test. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" invalid (RFC 6761) : local-zone: "invalid." static local-data: "invalid. 10800 IN NS localhost." local-data: "invalid. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800" reverse local use zones (RFC 1918) 10.in-addr.arpa 16.172.in-addr.arpa 31.172.in-addr.arpa 168.192.in-addr.arpa. local-zone static SOA NS local-data . special-use IPv4 Addresses (RFC 3330) 0.in-addr.arpa () 254.169.in-addr.arpa (link-local) 2.0.192.in-addr.arpa (TEST NET 1) 100.51.198.in-addr.arpa (TEST NET 2) 113.0.203.in-addr.arpa (TEST NET 3) 255.255.255.255.in-addr.arpa (broadcast). 64.100.in-addr.arpa 127.100.in-addr.arpa ( ). reverse IPv6 unspecified (RFC 4291) 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. reverse IPv6 Locally Assigned Local Addresses (RFC 4193) D.F.ip6.arpa. reverse IPv6 Link Local Addresses (RFC 4291) 8.E.F.ip6.arpa B.E.F.ip6.arpa. reverse IPv6 Example Prefix 8.B.D.0.1.0.0.2.ip6.arpa. . : local-zone: 8.B.D.0.1.0.0.2.ip6.arpa. nodefault local-zone . . local-data: "" . local-zone redirect . local-zone . local-data local-zone transparent local-zone . TXT : local-data: 'example. TXT "text"' NOTE: CNAME/DNAME DNSSEC stub-zone . local-data-ptr: "IPaddr name" PTR IPv4 IPv6 . "192.0.2.4 www.example.com". TTL : "2001:db8::4 7200 www.example.com" local-zone-tag: <"list of tags"> . access-control . define-tag . ("") . local-zone-tag . local-zone-override: . ( ) access-control-tag-action . response-ip: respip . IP AAAA A IP . access-control-tag-action . response-ip local-zone << >> . response-ip : static refuse transparent typetransparent nodefault response-ip . . deny . deny . response-ip-data: <"resource record string"> respip . response-ip <"resource record string"> . <"Resource record string"> access-control-tag-data AAAA A CNAME . IPv6/IPv4 AAAA/A CNAME ( IP ). CNAME response-ip-data . CNAME CNAME . CNAME (".") . response-ip-tag: <"list of tags"> respip . . IP AAAA A IP . access-control-tag IP access-control-tag-action . access-control-tag local-zone . local-zone-tag response-ip-tag response-ip . response-ip-tag . . access-control-tag-action response-ip-tag response-ip <<>> access-control-tag-action . response-ip-data NOERROR/NODATA NXDOMAIN response-ip qname . static response-ip NOERROR/NODATA . NXDOMAIN always_nxdomain . ratelimit: . 0 . . . (SERVFAIL) . . . . 1000 unbound . . NS . . . ratelimit-factor . NOTE: . : 0 ratelimit-size: . m () k () g () . ratelimit . : 4m ratelimit-slabs: . . 2 . () . 2 . : () ratelimit-factor: . 0 . 1 . 10 1/10 . ( ) . : 10 ratelimit-backoff: . 2 . ratelimit-factor 2 . ratelimit . : no ratelimit-for-domain: ratelimit . . . 0 . ratelimit-below-domain: ratelimit . . qps . ratelimit-for-domain . 0 . ip-ratelimit: IP . . . (SERVFAIL ) . IP . . DNS . ip-ratelimit-cookie . : 0 () ip-ratelimit-cookie: IP DNS . . . (SERVFAIL ) . IP . allow_cookie UDP ( Unbound ) DNS . ip-ratelimit . : 0 () ip-ratelimit-size: . m () k () g () . IP ratelimit . : 4m ip-ratelimit-slabs: IP. . 2 . () . 2 . : () ip-ratelimit-factor: . 0 . 1 . 10 1/10 . ( ) . : 10 ip-ratelimit-backoff: . 2 . ip-ratelimit-factor 2 . ip-ratelimit . : no outbound-msg-retry: Unbound . ( ) . forward/stub . : 5 max-sent-count: Unbound NS . SERVFAIL . ( CNAME) . : 32 max-query-restarts: Unbound CNAME . SERVFAIL . CNAME CNAME . CNAME . CNAME Unbound () . : 11 iter-scrub-ns: NS rrset NS . NS . : 20 iter-scrub-cname: CNAME DNAME . . . : 11 iter-scrub-rrsig: RRSIG RRset . RRSIG . RRSIG . : 8 max-global-quota: . . . : 200 iter-scrub-promiscuous: NS . . : yes fast-server-permil: 1000 . 0 . 900 90 . prefetch ( serve-expired) . fast-server-num . : 0 fast-server-num: . fast-server-permil . : 3 answer-cookie: Unbound DNS RFC 7873 RFC 9018 . : no cookie-secret: "<128 bit hex string>" DNS. anycast . "000102030405060708090a0b0c0d0e0f". NOTE: cookie-secret-file . DNS . : 128 cookie-secret-file: DNS . cookie-secret . "/usr/local/etc/unbound_cookiesecrets.txt" . add_cookie_secret drop_cookie_secret activate_cookie_secret unbound-control(8) . . : "" () edns-client-string: EDNS0 ASCII . . . edns-client-string-opcode: EDNS0 edns-client-string 0 65535. << />> (65001-65534) . : 65001 ede: Unbound DNS (RFC 8914) . EDE DNS DNSSEC . val-log-level 2 DNS DNSSEC . : no ede-serve-expired: Unbound DNS (RFC 8914) 3 - EDNS0 . NOTE: ede: yes . : no dns-error-reporting: Unbound DNS (RFC 9567) . EDNS0 Report-Channel . DNS (RFC 8914) Unbound . ede . qname-minimisation . : no (REMOTE CONTROL OPTIONS) remote-control: . unbound-control(8) Unbound . TLS . unbound-control(8) remote-control: . unbound-control-setup(8) . control-enable: . . : no control-interface: IPv4 IPv6 . IP IP . localhost (127.0.0.1 ::1) . 0.0.0.0 ::0 . . . . Unbound . . . control-port: IPv4 IPv6. NOTE: . : 8953 control-use-cert: control-interface localhost TLS "no" . TLS . : yes server-key-file: . unbound-control-setup(8) . Unbound unbound-control(8) . : unbound_server.key server-cert-file: . unbound-control-setup(8) . Unbound unbound-control(8) . : unbound_server.pem control-key-file: . unbound-control-setup(8) . unbound-control(8) . : unbound_control.key control-cert-file: . . unbound-control-setup(8) . unbound-control(8) . : unbound_control.pem (STUB ZONE OPTIONS) stub-zone: . stub-zone: . name IP. . IN . Unbound . . . ( ) . Unbound : stub-addr: Unbound . DNSSEC Unbound AD ( AD ). Unbound AD (<<>>) AA (<<>>) . server domain-insecure local-zone: nodefault . domain-insecure DNSSEC . local-zone: nodefault ( transparent) () RFC 1918 Unbound . name: . . stub-host: . . CAUTION: ( ) IP . stub-addr . stub-first: yes . . DNS '@' . TLS '#' TLS . '@' '#' '@' . '#' tls-port . stub-addr: IP . IPv4 IPv6 . DNS '@' . TLS '#' tls . '@' '#' '@' . '#' tls-port . stub-prime: NS . . : no stub-first: stub . SERVFAIL stub . forward/stub/auth . : no stub-tls-upstream: TLS stub . : no stub-ssl-upstream: stub-tls-upstream. stub-tcp-upstream: "yes" tcp-upstream TCP . : no stub-no-cache: stub . . : no (FORWARD ZONE OPTIONS) forward-zone: . forward-zone: . name IP. . forward-host forward-addr . ( Unbound) Unbound . IN . CNAME Unbound . forward-zone "." forward-addr ( ). name: . . forward-host: . . CAUTION: ( ) IP . forward-addr . forward-first: yes . . DNS '@' . TLS '#' TLS . '@' '#' '@' . '#' tls-port . forward-addr: IP . IPv4 IPv6 . DNS '@' . TLS '#' tls . '@' '#' '@' . '#' tls-port . TLS TLS . '#' forward-addr . CA tls-cert-bundle . forward-first: SERVFAIL Unbound . forward/stub/auth . : no forward-tls-upstream: TLS . tls-cert-bundle tls-win-cert CA . : no forward-ssl-upstream: forward-tls-upstream. forward-tcp-upstream: "yes" tcp-upstream TCP . : no forward-no-cache: . . : no / (AUTHORITY ZONE OPTIONS) auth-zone: . auth-zone: name . auth-zone . . . for-downstream: yes () local-zones . Unbound . CNAME . for-upstream: yes () . . () Unbound . for-downstream: no for-upstream: yes . CNAME . zonefile . AXFR IXFR . . SOA SOA UDP . SOA . SOA . . SERVFAIL ( ) SERVFAIL . name: . primary: AXFR IXFR. . . DNS '@' . '#' AXFR TLS TLS . '@' '#' '@' . Unbound AXFR/IXFR url zonefile . CAUTION: zonefile IP IP . master: primary. url: . HTTP HTTPS. url: http://www.example.com/example.org.zone url . url SOA . UDP SOA SOA . url IXFR AXFR . HTTPS tls-cert-bundle url . URL zonefile IP IP . "http://192.0.2.1/unbound-primaries/example.com.zone" IP . allow-notify: allow-notify . . . . url . NOTE: primary url . fallback-enabled: Unbound . DNSSEC. : no for-downstream: Unbound . Unbound . Unbound . for-downstream: no for-upstream: yes Unbound DNSSEC . : yes for-upstream: Unbound . . Unbound . : yes zonemd-check: ZONEMD . ZONEMD . glue . DNSSEC DNSSEC . : no zonemd-reject-absence: ZONEMD . ZONEMD . DNSSEC ZONEMD ZONEMD . zonemd-permissive-mode . ZONEMD DNSSEC DNSSEC ZONEMD . ZONEMD DNSSEC. : no zonefile: . . Unbound ( ). max-transfer-size: . AXFR IXFR HTTP . 'k' 'm' 'g' (1024*1024 ). 0 . / . : 0 max-transfer-time: . 0 . / . : 0 (VIEW OPTIONS) view: . view: . name local-zone local-data. view-first response-ip response-ip-data local-data-ptr . access-control-view . . . name: . . access-control-view . local-zone: . local-zone . local-zone: view-first: no . nodefault . view-first: yes local-zone local-zone . local-data: "" . local-data . local-data-ptr: "IPaddr name" local-data-ptr . local-data-ptr . response-ip: respip . response-ip . response-ip-data: <"resource record string"> respip . response-ip-data . view-first: local-zone local-data . : no (PYTHON MODULE OPTIONS) python: . python: python(1) . iterator validator . python module-config ( validator iterator). python . chroot bind mount mount(8) . python-script . python-script: . module-config . (DYNAMIC LIBRARY MODULE OPTIONS) dynlib: . dynlib: dynlib . . dynlib dynlib module-config . dynlib . dynlib-file chroot . dynlib-file: . dynlib module-config . DNS64 (DNS64 MODULE OPTIONS) server: . dns64 module-config : module-config: "dns64 validator iterator" . NOTE: respip dns64 respip dns64 module-config IP / RPZ DNS64 . dns64-prefix: DNS64 AAAA . 96/ . : 64:ff9b::/96 dns64-synthall: WARNING: ! AAAA AAAA . : no dns64-ignore-aaaa: AAAA A DNS64 . . . NAT64 (NAT64 OPTIONS) server: . NAT64 NAT64 IPv4 . do-nat64: NAT64 IPv4 . prefer-ip6 IPv6 . : no nat64-prefix: NAT64 IPv4. 32/ 40/ 48/ 56/ 64/ 96/ . NAT64 do-not-query-address NAT64 . IPv4 do-not-query-address . NAT64 do-not-query-address IPv6 NAT64 . : 64:ff9b::/96 ( dns64-prefix) DNSCRYPT (DNSCRYPT OPTIONS) dnscrypt: . dnscrypt: dnscrypt . Unbound --enable-dnscrypt . / Unbound . dnscrypt-wrapper : https://github.com/cofyc/dnscrypt-wrapper/blob/master/README.md#usage dnscrypt-enable: dnscrypt . . : no dnscrypt-port: dnscrypt . NOTE: interface server: . dnscrypt-provider: . : 2.dnscrypt-cert.example.com. IMPORTANT: MUST . dnscrypt-secret-key: . . dnscrypt-provider-cert: dnscrypt-secret-key. . dnscrypt-provider-cert-rotated: TXT dnscrypt-provider . client magic . / anycast . . . dnscrypt-shared-secret-cache-size: . m () k () g (). . . : 4m dnscrypt-shared-secret-cache-slabs: dnscrypt. . 2 . () . 2 . : () dnscrypt-nonce-cache-size: . m () k () g (). dnscrypt . / . : 4m dnscrypt-nonce-cache-slabs: dnscrypt. . 2 . () . 2 . : () EDNS (EDNS CLIENT SUBNET MODULE OPTIONS) server: . ECS module-config : module-config: "subnetcache validator iterator" . Unbound EDNS0 . ECS . . Unbound send-client-subnet . client-subnet-always-forward: yes . . ECS msg-cache-size . 100 . . EDNS IP . subnetcache . . serve-expired* prefetch . send-client-subnet: . num/ 10.2.3.4/24 2001::11/64. . edns-subnet client-subnet-zone . client-subnet-zone: . . edns-subnet send-client-subnet . client-subnet-always-forward: ECS ( send-client-subnet) ECS ECS ( ECS ). ECS . . : no max-client-subnet-ipv6: IPv6 . : 56 max-client-subnet-ipv4: IPv4 . : 24 min-client-subnet-ipv6: IPv6 . REFUSED . 0 . : 0 min-client-subnet-ipv4: IPv4 . REFUSED . 0 . : 0 max-ecs-tree-size-ipv4: ECS ECS . qname/qclass/qtype . : 100 max-ecs-tree-size-ipv6: ECS ECS . qname/qclass/qtype . : 100 IPSEC (OPPORTUNISTIC IPSEC SUPPORT MODULE OPTIONS) server: . IPsec module-config : module-config: "ipsecmod validator iterator" --enable-ipsecmod Unbound . Unbound A/AAAA IPSECKEY . Unbound : QNAME A/AAAA IPSECKEY. . IPSECKEY TTL TTL IPSECKEY. A/AAAA IP A/AAAA. IP . IPSECKEY RDATA IPSECKEY IPSECKEY. RDATA IPSECKEY DNS . A/AAAA . TTL ipsecmod-max-ttl . prefetch: yes A/AAAA . ipsecmod-max-ttl A/AAAA IPsec . ipsecmod-enabled: IPsec . IPsec module-config . / / Unbound . : yes ipsecmod-hook: Unbound system(3) . / . Unbound . IPsec module-config . ipsecmod-strict: Unbound 0 . Unbound SERVFAIL . A/AAAA . : no ipsecmod-max-ttl: A/AAAA . : 3600 ipsecmod-ignore-bogus: Unbound IPSECKEY . yes A/AAAA . no A/AAAA SERVFAIL . . : no ipsecmod-allow: IPsec . . (). ipsecmod-whitelist: ipsecmod-allow. (CACHE DB MODULE OPTIONS) cachedb: . Cache DB module-config : module-config: "validator cachedb iterator" --enable-cachedb . Unbound . Unbound DNS . Unbound . serve-expired-* Unbound . Unbound --with-libhiredis C hiredis redis . Redis TCP . / . NOTE: Unbound Redis TTL DNS Redis Redis (LRU). redis-expire-records TTL DNS Redis Redis ( ). Redis . Redis DNS . . Unbound . . cachedb: cache DB . backend: . testframe . redis . : testframe secret-seed: "" . . Unbound . : "default" cachedb-no-store: . dns . . : no cachedb-check-when-serve-expired: cachedb . serve-expired serve-expired-client-timeout cachedb . cachedb . serve-expired-client-timeout . . : yes cachedb: redis . redis-server-host: IP ( v6 v4) Redis. IP Unbound . : 127.0.0.1 redis-server-port: TCP Redis. : 6379 redis-server-path: Redis. IP . : "" () redis-server-password: "" AUTH Redis. Redis . : "" () redis-timeout: Unbound Redis . Unbound Redis . : 100 redis-command-timeout: Redis . 0 redis-timeout . : 0 redis-connect-timeout: Redis . 0 redis-timeout . : 0 redis-expire-records: Redis . yes Unbound Redis Redis . Unbound serve-expired serve-expired-ttl: 0 "no" . NOTE: "SET ... EX" Redis (Redis >= 2.6.12). : no redis-logical-db: Redis . Redis RDB/AOF . Redis Redis (https://redis.io/commands/select). Redis 0 SELECT . : 0 redis-replica-server-host: IP ( v6 v4) Redis. IP Unbound . (https://redis.io/docs/management/replication/#read-only-replica). Redis redis-server-host . : "" () redis-replica-server-port: TCP Redis. : 6379 redis-replica-server-path: Redis. IP . : "" () redis-replica-server-password: "" AUTH Redis. Redis . : "" () redis-replica-timeout: Unbound Redis . Unbound Redis . : 100 redis-replica-command-timeout: Redis . 0 redis-replica-timeout . : 0 redis-replica-connect-timeout: Redis . 0 redis-replica-timeout . : 0 redis-replica-logical-db: redis-logical-db Redis. : 0 DNSTAP (DNSTAP OPTIONS) dnstap: . DNSTAP DNS . --enable-dnstap dnstap: . ( ) . Unbound . dnstap-enable: dnstap . yes DNSTAP dnstap-log-..-messages: . : no dnstap-bidirectional: DNSTAP. : yes dnstap-socket-path: . : /etc/unbound/dnstap.sock dnstap-ip: "" IP ( IPv4 IPv6) . : "" dnstap-tls: TLS dnstap-ip . no TCP . : yes dnstap-tls-server-name: TLS . dnstap-tls: yes . "" . : "" dnstap-tls-cert-bundle: pem TLS. "" . : "" dnstap-tls-client-key-file: TLS. "" . : "" dnstap-tls-client-cert-file: TLS. : "" dnstap-send-identity: . : no dnstap-send-version: . : no dnstap-identity: "" . : "" dnstap-version: "" . : "" dnstap-sample-rate: 1/N . 0 . . 10 1/10 100 . : 0 () dnstap-log-resolver-query-messages: . Unbound . : no dnstap-log-resolver-response-messages: . Unbound . : no dnstap-log-client-query-messages: . Unbound . : no dnstap-log-client-response-messages: . Unbound . : no dnstap-log-forwarder-query-messages: . : no dnstap-log-forwarder-response-messages: . : no (RESPONSE POLICY ZONE OPTIONS) rpz: . rpz: name . rpz: . RPZ RPZ RPZ . PASSTHRU . respip module-config : module-config: "respip validator iterator" NOTE: respip dns64 respip dns64 module-config IP / RPZ DNS64 . QNAME IP nsdname nsip clientip . : NXDOMAIN NODATA PASSTHRU DROP tcp-only drop. QNAME RPZ local-zone auth-zone . RPZ DNS SOA . () (). . zonefile . RPZ example.com NXDOMAIN : example.com CNAME . : name query name netblock.rpz-client-ip client IP address netblock.rpz-ip response IP address in the answer name.rpz-nsdname nameserver name netblock.rpz-nsip nameserver IP address . . IPv6 'zz' '::' . 32 128 . 24.10.100.51.198.rpz-ip 198.51.100.10/24 32.10.zz.db8.2001.rpz-ip 2001:db8:0:0:0:0:0:10/32 . : CNAME . nxdomain reply CNAME *. nodata reply CNAME rpz-passthru. do nothing, allow to continue CNAME rpz-drop. the query is dropped CNAME rpz-tcp-only. answer over TCP A 192.0.2.1 answer with this IP address AAAA TXT CNAME ( rpz-..) . name: . primary: AXFR IXFR. . . DNS '@' . '#' AXFR TLS TLS . '@' '#' '@' . Unbound AXFR/IXFR url zonefile . zonefile IP IP . IXFR AXFR . rpz . 5 IXFR . master: primary. url: . HTTP HTTPS. url: http://www.example.com/example.org.zone url . url SOA . UDP SOA SOA . URL IXFR AXFR . HTTPS tls-cert-bundle url . allow-notify: allow-notify . . . . url . NOTE: primary url . zonefile: . . Unbound ( ). rpz-action-override: RPZ . : nxdomain nodata passthru drop disabled cname. rpz-cname-override: CNAME cname rpz-action-override . rpz-log: RPZ RPZ. : no rpz-log-name: . rpz-signal-nxdomain-ra: RPZ NXDOMAIN RA. dnsmasq . : no for-downstream: RPZ . SOA RPZ . : no tags: "" RPZ . define-tag access-control-tag interface-tag . ("") . . max-transfer-size: . AXFR IXFR HTTP . 'k' 'm' 'g' (1024*1024 ). 0 . / . : 0 max-transfer-time: . 0 . / . : 0 (MEMORY CONTROL EXAMPLE) . TCP . TCP DNS . DNSSEC . 3 . BSD-32bit 30 40 . # example settings that reduce memory usage server: num-threads: 1 outgoing-num-tcp: 1 # this limits TCP service, uses less buffers. incoming-num-tcp: 1 outgoing-range: 60 # uses less memory, but less performance. msg-buffer-size: 8192 # note this limits service, 'no huge stuff'. msg-cache-size: 100k msg-cache-slabs: 1 rrset-cache-size: 100k rrset-cache-slabs: 1 infra-cache-numhosts: 200 infra-cache-slabs: 1 key-cache-size: 100k key-cache-slabs: 1 neg-cache-size: 10k num-queries-per-thread: 30 target-fetch-policy: "2 1 0 0 0 0" harden-large-queries: "yes" harden-short-bufsize: "yes" (FILES) /etc/unbound Unbound. /etc/unbound chroot(2). /etc/unbound/unbound.conf Unbound. /run/unbound.pid pid Unbound . unbound.log Unbound. syslog(3) . (SEE ALSO) unbound(8), unbound-checkconf(8). (AUTHOR) Unbound CREDITS . (COPYRIGHT) 1999-2026, NLnet Labs 1.26.0 August 4, 2026 UNBOUND.CONF(5)