incoming:
  listen:
    - 127.0.0.1:5300
  allow_from:
    - 127.0.0.1
  udp_truncation_threshold: 1232
  reuseport: true
  pdns_distributes_queries: false
  distributor_threads: 0
  max_tcp_clients: 1024
  tcp_timeout: 10
  max_concurrent_requests_per_tcp_connection: 20
  edns_padding_from:
    - 127.0.0.1
  edns_padding_mode: always

outgoing:
  source_address:
    - 185.250.250.61
    - '2a0a:51c1:a:ea::'
  edns_bufsize: 1232
  edns_subnet_allow_list: []
  lowercase: true
  tcp_fast_open_connect: true
  max_qperq: 50
  max_bytesperq: 65535
  max_ns_address_qperq: 10
  max_ns_per_resolve: 5
  server_down_max_fails: 64
  server_down_throttle_time: 60
  non_resolving_ns_max_fails: 5
  non_resolving_ns_throttle_time: 60

recursor:
  threads: 2
  max_mthreads: 4096
  max_total_msec: 4000
  daemon: false
  server_id: "DNSBunker"
  version_string: "DNS: Turning names into problems since 1983"
  security_poll_suffix: ""
  serve_rfc1918: true
  serve_rfc6303: true
  qname_minimization: true
  extended_resolution_errors: true

  rpzs:
    - name: /etc/powerdns/rpz/00-local.rpz
      policyName: local
    - name: /etc/powerdns/rpz/10-allow.rpz
      policyName: hagezi-allow
    - name: /etc/powerdns/rpz/20-deny.rpz
      policyName: hagezi-deny
      defpol: Custom
      defcontent: local.blocked.rpz.dnsbunker.org
      defttl: 300
      maxTTL: 300
      extendedErrorCode: 15
      extendedErrorExtra: "Blocked by DNSBunker"
    - name: /etc/powerdns/rpz/40-tif.rpz
      policyName: hagezi-tif
      zoneSizeHint: 5000000
      defpol: Custom
      defcontent: tif.blocked.rpz.dnsbunker.org
      defttl: 300
      maxTTL: 300
      extendedErrorCode: 15
      extendedErrorExtra: "Blocked by DNSBunker (HaGeZi TIF)"
    - name: /etc/powerdns/rpz/30-pro.rpz
      policyName: hagezi-pro
      zoneSizeHint: 500000
      defpol: Custom
      defcontent: pro.blocked.rpz.dnsbunker.org
      defttl: 300
      maxTTL: 300
      extendedErrorCode: 15
      extendedErrorExtra: "Blocked by DNSBunker (HaGeZi Pro)"

  auth_zones:
    - zone: rpz.dnsbunker.org
      file: /etc/powerdns/zones/rpz.dnsbunker.org.zone

dnssec:
  validation: validate
  aggressive_nsec_cache_size: 100000

recordcache:
  max_entries: 2000000
  shards: 1024
  serve_stale_extensions: 2880
  zonetocaches:
    - zone: "."
      method: url
      sources:
        - "https://www.internic.net/domain/root.zone"
      refreshPeriod: 14400
      retryOnErrorPeriod: 1800
      dnssec: require
      zonemd: require
    - zone: "arpa"
      method: url
      sources:
        - "https://www.internic.net/domain/arpa.zone"
      refreshPeriod: 14400
      retryOnErrorPeriod: 1800
      dnssec: require
    - zone: "in-addr.arpa"
      method: url
      sources:
        - "https://www.internic.net/domain/in-addr.arpa.zone"
      refreshPeriod: 14400
      retryOnErrorPeriod: 1800
      dnssec: require
    - zone: "ip6.arpa"
      method: url
      sources:
        - "https://www.internic.net/domain/ip6.arpa.zone"
      refreshPeriod: 14400
      retryOnErrorPeriod: 1800
      dnssec: require

packetcache:
  disable: true