# Allow forwarding of private ranges, which are marked forwardable by IANA
# https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
# https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
# https://www.iana.org/assignments/special-use-domain-names/special-use-domain-names.xhtml
# RFC 6303: Locally Served DNS Zones (https://www.rfc-editor.org/rfc/rfc6303.html)
#
# Using this configuration file will simplify forwarding to potentially private ranges.
# Enables forwarding of networks marked as forwardable at IANA special registry.
# This is useful when upstream forwarder may be still inside private network. That is the case
# when unbound works as a localhost DNS cache, not network wide resolver.

server:
	# RFC 8375: Special-Use Domain 'home.arpa.'
	local-zone: "home.arpa." nodefault

	# RFC 1918: Address Allocation for Private Internets
	local-zone: "10.in-addr.arpa." nodefault
	local-zone: "16.172.in-addr.arpa." nodefault
	local-zone: "17.172.in-addr.arpa." nodefault
	local-zone: "18.172.in-addr.arpa." nodefault
	local-zone: "19.172.in-addr.arpa." nodefault
	local-zone: "20.172.in-addr.arpa." nodefault
	local-zone: "21.172.in-addr.arpa." nodefault
	local-zone: "22.172.in-addr.arpa." nodefault
	local-zone: "23.172.in-addr.arpa." nodefault
	local-zone: "24.172.in-addr.arpa." nodefault
	local-zone: "25.172.in-addr.arpa." nodefault
	local-zone: "26.172.in-addr.arpa." nodefault
	local-zone: "27.172.in-addr.arpa." nodefault
	local-zone: "28.172.in-addr.arpa." nodefault
	local-zone: "29.172.in-addr.arpa." nodefault
	local-zone: "30.172.in-addr.arpa." nodefault
	local-zone: "31.172.in-addr.arpa." nodefault
	local-zone: "168.192.in-addr.arpa." nodefault
	# RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space
	local-zone: "64.100.in-addr.arpa." nodefault
	local-zone: "65.100.in-addr.arpa." nodefault
	local-zone: "66.100.in-addr.arpa." nodefault
	local-zone: "67.100.in-addr.arpa." nodefault
	local-zone: "68.100.in-addr.arpa." nodefault
	local-zone: "69.100.in-addr.arpa." nodefault
	local-zone: "70.100.in-addr.arpa." nodefault
	local-zone: "71.100.in-addr.arpa." nodefault
	local-zone: "72.100.in-addr.arpa." nodefault
	local-zone: "73.100.in-addr.arpa." nodefault
	local-zone: "74.100.in-addr.arpa." nodefault
	local-zone: "75.100.in-addr.arpa." nodefault
	local-zone: "76.100.in-addr.arpa." nodefault
	local-zone: "77.100.in-addr.arpa." nodefault
	local-zone: "78.100.in-addr.arpa." nodefault
	local-zone: "79.100.in-addr.arpa." nodefault
	local-zone: "80.100.in-addr.arpa." nodefault
	local-zone: "81.100.in-addr.arpa." nodefault
	local-zone: "82.100.in-addr.arpa." nodefault
	local-zone: "83.100.in-addr.arpa." nodefault
	local-zone: "84.100.in-addr.arpa." nodefault
	local-zone: "85.100.in-addr.arpa." nodefault
	local-zone: "86.100.in-addr.arpa." nodefault
	local-zone: "87.100.in-addr.arpa." nodefault
	local-zone: "88.100.in-addr.arpa." nodefault
	local-zone: "89.100.in-addr.arpa." nodefault
	local-zone: "90.100.in-addr.arpa." nodefault
	local-zone: "91.100.in-addr.arpa." nodefault
	local-zone: "92.100.in-addr.arpa." nodefault
	local-zone: "93.100.in-addr.arpa." nodefault
	local-zone: "94.100.in-addr.arpa." nodefault
	local-zone: "95.100.in-addr.arpa." nodefault
	local-zone: "96.100.in-addr.arpa." nodefault
	local-zone: "97.100.in-addr.arpa." nodefault
	local-zone: "98.100.in-addr.arpa." nodefault
	local-zone: "99.100.in-addr.arpa." nodefault
	local-zone: "100.100.in-addr.arpa." nodefault
	local-zone: "101.100.in-addr.arpa." nodefault
	local-zone: "102.100.in-addr.arpa." nodefault
	local-zone: "103.100.in-addr.arpa." nodefault
	local-zone: "104.100.in-addr.arpa." nodefault
	local-zone: "105.100.in-addr.arpa." nodefault
	local-zone: "106.100.in-addr.arpa." nodefault
	local-zone: "107.100.in-addr.arpa." nodefault
	local-zone: "108.100.in-addr.arpa." nodefault
	local-zone: "109.100.in-addr.arpa." nodefault
	local-zone: "110.100.in-addr.arpa." nodefault
	local-zone: "111.100.in-addr.arpa." nodefault
	local-zone: "112.100.in-addr.arpa." nodefault
	local-zone: "113.100.in-addr.arpa." nodefault
	local-zone: "114.100.in-addr.arpa." nodefault
	local-zone: "115.100.in-addr.arpa." nodefault
	local-zone: "116.100.in-addr.arpa." nodefault
	local-zone: "117.100.in-addr.arpa." nodefault
	local-zone: "118.100.in-addr.arpa." nodefault
	local-zone: "119.100.in-addr.arpa." nodefault
	local-zone: "120.100.in-addr.arpa." nodefault
	local-zone: "121.100.in-addr.arpa." nodefault
	local-zone: "122.100.in-addr.arpa." nodefault
	local-zone: "123.100.in-addr.arpa." nodefault
	local-zone: "124.100.in-addr.arpa." nodefault
	local-zone: "125.100.in-addr.arpa." nodefault
	local-zone: "126.100.in-addr.arpa." nodefault
	local-zone: "127.100.in-addr.arpa." nodefault

	# RFC 4193: Unique Local IPv6 Unicast Addresses
	local-zone: "d.f.ip6.arpa." nodefault

	# RFC 2606: Reserved Top Level DNS Names
	local-zone:      "test." nodefault
	domain-insecure: "test"
	domain-insecure: "example"

	# RFC 6762: Multicast DNS, Appendix G
	domain-insecure: "local"
	domain-insecure: "intranet"
	domain-insecure: "private"
	domain-insecure: "corp"
	domain-insecure: "home"
	domain-insecure: "lan"

	# draft-davies-internal-tld
	domain-insecure: "internal"