diff --git a/roles/unbound/templates/custom-vpn.conf.j2 b/roles/unbound/templates/custom-vpn.conf.j2
index bd62469..e335172 100644
--- a/roles/unbound/templates/custom-vpn.conf.j2
+++ b/roles/unbound/templates/custom-vpn.conf.j2
@@ -5,9 +5,9 @@ view:
 {% if unbound_custom_vpn_records is defined %}
 {% for host, ips in unbound_custom_vpn_records.items() %}
     local-data: "{{ host }}.        IN A {{ ips.v4 }}"
-    {% if ips.v6 is defined %}
+{% if ips.v6 is defined %}
     local-data: "{{ host }}.        IN AAAA {{ ips.v6 }}"
-    {% endif %}
+{% endif %}
 {% endfor %}
 {% endif %}
 
diff --git a/roles/unbound/templates/unbound.conf.j2 b/roles/unbound/templates/unbound.conf.j2
index 6086587..dbcb6f2 100644
--- a/roles/unbound/templates/unbound.conf.j2
+++ b/roles/unbound/templates/unbound.conf.j2
@@ -26,8 +26,8 @@ server:
     access-control: ::1 allow
 
     # Specify custom local answers for each interface by using views:
-    access-control-view: 192.168.1.56/24 lan
-    access-control-view: 192.168.27.1/27 vpn
+    access-control-view: 192.168.1.0/24 lan
+    access-control-view: 192.168.27.0/27 vpn
 
     do-ip4: yes
     do-udp: yes
@@ -59,13 +59,19 @@ server:
     use-caps-for-id: no
 
     # the time to live (TTL) value lower bound, in seconds. Default 0.
-    # If more than an hour could easily give trouble due to stale data.
-    cache-min-ttl: 3600
+    # Setting to 0 respects upstream TTLs, avoiding outages on fast-flux services.
+    cache-min-ttl: 0
 
     # the time to live (TTL) value cap for RRsets and messages in the
     # cache. Items are not cached for longer. In seconds.
     cache-max-ttl: 86400
 
+    # Serve expired records while fetching fresh ones in the background.
+    # Improves reliability when upstream resolvers are temporarily unavailable.
+    serve-expired: yes
+    serve-expired-ttl: 86400
+    serve-expired-client-timeout: 0
+
     # Reduce EDNS reassembly buffer size.
     # IP fragmentation is unreliable on the Internet today, and can cause
     # transmission failures when large DNS messages are sent via UDP. Even
@@ -89,14 +95,20 @@ server:
     # see: https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#unbound-conf-prefetch
     prefetch: no
 
-    # One thread should be sufficient, can be increased on beefy machines.
-    # In reality for most users running on small networks or on a single machine,
-    # it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
-    num-threads: 1
+    # Threads and cache slabs optimized for 4-core CPU
+    num-threads: 4
+    msg-cache-slabs: 4
+    rrset-cache-slabs: 4
+    infra-cache-slabs: 4
+    key-cache-slabs: 4
+
+    # Cache sizes optimized for 64GB RAM
+    msg-cache-size: 512m
+    rrset-cache-size: 1g
 
     # Ensure kernel buffer is large enough to not lose messages in traffic spikes
-    so-rcvbuf: 1m
-    so-sndbuf: 0
+    so-rcvbuf: 4m
+    so-sndbuf: 4m
 
     # Ensure privacy of local IP ranges
     private-address: 192.168.0.0/16