unbound.conf

server:
    interface: lo0
    interface: igc1
    interface: igc2
    interface: igc3

    ip-transparent: yes

    do-ip6: yes
    prefer-ip6: no

    access-control: 127.0.0.0/8 allow
    access-control: 10.0.1.0/24 allow
    access-control: 10.0.2.0/24 allow
    access-control: 10.0.3.0/24 allow

    access-control: 0.0.0.0/0 refuse

    access-control: ::1 allow
    access-control: fe80::/10 allow
    access-control: fda3:650d:dbbd::/48 allow

    access-control: ::0/0 refuse

    hide-identity: yes
    hide-version: yes

    # Perform DNSSEC validation.
    #
    auto-trust-anchor-file: "/var/unbound/db/root.key"
    val-log-level: 2

    # Uncomment to synthesize NXDOMAINs from DNSSEC NSEC chains
    # https://tools.ietf.org/html/rfc8198
    #
    aggressive-nsec: yes

    # Use TCP for "forward-zone" requests. Useful if you are making
    # DNS requests over an SSH port forwarding.
    #
    #tcp-upstream: yes

    # CA Certificates used for forward-tls-upstream (RFC7858) hostname
    # verification.  Since it's outside the chroot it is only loaded at
    # startup and thus cannot be changed via a reload.
    tls-cert-bundle: "/etc/ssl/cert.pem"

    # Include file for local-data and local-data-ptr
    include: /var/unbound/etc/internal-zone.conf

remote-control:
    control-enable: yes
    control-interface: /var/run/unbound.sock

forward-zone:
    name: "."

    forward-tls-upstream: yes
    forward-first: no

    # the hostname after "#" is not a comment, it is used for TLS checks:
    forward-addr: 1.1.1.1@853#cloudflare-dns.com
    forward-addr: 1.0.0.1@853#cloudflare-dns.com
    forward-addr: 2606:4700:4700::1111@853#cloudflare-dns.com
    forward-addr: 2606:4700:4700::1001@853#cloudflare-dns.com