server:
    interface: 127.0.0.1
    port: 5353
    do-ip4: yes
    do-ip6: yes
    do-udp: yes
    do-tcp: yes

    root-hints: "/var/lib/unbound/root.hints"
    auto-trust-anchor-file: "/var/lib/unbound/root.key"

    hide-identity: yes
    hide-version: yes
    harden-glue: yes
    harden-dnssec-stripped: yes
    use-caps-for-id: yes

    cache-min-ttl: 3600
    cache-max-ttl: 86400

    access-control: 127.0.0.1/8 allow
    access-control: 192.168.33.0/24 allow

    # Fix DNSSEC + prefetch conflict
    prefetch: yes
    prefetch-key: yes
    module-config: "validator iterator"