caca

named.conf

@@ -0,0 +1,45 @@
+// vim:set ts=4 sw=4 et:
+
+options {
+	directory "/var/named";
+	pid-file "/run/named/named.pid";
+
+	// Uncomment these to enable IPv6 connections support
+	// IPv4 will still work:
+	//  listen-on-v6 { any; };
+	// Add this for no IPv4:
+	listen-on port 53 { 127.0.0.1; 186.64.123.31; };
+
+	allow-recursion { any; };
+	allow-query-cache { any; };
+	allow-query { any; };
+	allow-transfer { none; };
+
+	max-cache-ttl 30;
+	max-ncache-ttl 30;
+
+	// version none;
+	// hostname none;
+	// server-id none;
+	recursion yes;
+	querylog yes;
+
+	# DNSSEC disabled because the main purpose is to use it behind
+	# this server DoT, dns.zzls.xyz=186.64.123.31
+	dnssec-validation no;
+};
+
+zone "localhost" IN {
+	type master;
+	file "localhost.zone";
+};
+
+zone "0.0.127.in-addr.arpa" IN {
+	type master;
+	file "127.0.0.zone";
+};
+
+zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" {
+	type master;
+	file "localhost.ip6.zone";
+};

unbound/unbound.conf.d/caca.conf

@@ -0,0 +1,89 @@
+# Unbound config file
+server:
+# If no logfile is specified, syslog is used
+#logfile: "/var/log/unbound/unbound.log"
+verbosity: 3
+
+interface: 127.0.0.1
+interface: 186.64.123.31
+port: 53
+do-ip4: yes
+do-udp: yes
+do-tcp: yes
+
+# May be set to yes if you have IPv6 connectivity
+do-ip6: no
+
+# You want to leave this to no unless you have *native* IPv6. With 6to4 and
+# Terredo tunnels your web browser should favor IPv4 for the same reasons
+prefer-ip6: no
+
+# Use this only when you downloaded the list of primary root servers!
+# If you use the default dns-root-data package, unbound will find it automatically
+root-hints: "/etc/unbound/root.hints"
+
+# Trust glue only if it is within the server's authority
+harden-glue: yes
+
+# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
+harden-dnssec-stripped: yes
+
+trust-anchor-file: "/etc/unbound/trusted-key.key"
+
+# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
+# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
+use-caps-for-id: no
+
+# Reduce EDNS reassembly buffer size.
+# IP fragmentation is unreliable on the Internet today, and can cause
+# transmission failures when large DNS messages are sent via UDP. Even
+# when fragmentation does work, it may not be secure; it is theoretically
+# possible to spoof parts of a fragmented DNS message, without easy
+# detection at the receiving end. Recently, there was an excellent study
+# >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<<
+# by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/)
+# in collaboration with NLnet Labs explored DNS using real world data from the
+# the RIPE Atlas probes and the researchers suggested different values for
+# IPv4 and IPv6 and in different scenarios. They advise that servers should
+# be configured to limit DNS messages sent over UDP to a size that will not
+# trigger fragmentation on typical network links. DNS servers can switch
+# from UDP to TCP when a DNS response is too big to fit in this limited
+# buffer size. This value has also been suggested in DNS Flag Day 2020.
+edns-buffer-size: 1232
+
+# Perform prefetching of close to expired message cache entries
+# This only applies to domains that have been frequently queried
+prefetch: yes
+
+# One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
+num-threads: 1
+
+# Ensure kernel buffer is large enough to not lose messages in traffic spikes
+so-rcvbuf: 1m
+
+# Ensure privacy of local IP ranges
+#private-address: 192.168.0.0/16
+#private-address: 169.254.0.0/16
+#private-address: 172.16.0.0/12
+#private-address: 10.0.0.0/8
+#private-address: fd00::/8
+#private-address:0.0.0.0/0
+access-control: 0.0.0.0/0 allow
+
+# Hide DNS Server info
+#hide-identity: yes
+#hide-version: yes
+
+# Add an unwanted reply threshold to clean the cache and avoid, when possible, DNS poisoning
+#unwanted-reply-threshold: 10000000
+
+# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
+# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
+use-caps-for-id: no
+
+# Perform prefetching of close to expired message cache entries
+# This only applies to domains that have been frequently queried
+#prefetch: yes
+# Fetch the DNSKEYs earlier in the validation process, which lowers the latency of requests
+# but also uses a little more CPU
+#prefetch-key: yes