From 56fe5304c51d5a2cde03e46e8b58a56e64124c08 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20D=C3=A9siles?=
 <1536672+cdesiles@users.noreply.github.com>
Date: Tue, 8 Sep 2026 22:49:50 +0200
Subject: [PATCH] feat(unbound): enable prefetch, prefetch-key, and deny-any

---
 roles/unbound/templates/unbound.conf.j2 | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/roles/unbound/templates/unbound.conf.j2 b/roles/unbound/templates/unbound.conf.j2
index 64ecabe..a2e9b23 100644
--- a/roles/unbound/templates/unbound.conf.j2
+++ b/roles/unbound/templates/unbound.conf.j2
@@ -96,9 +96,12 @@ server:
 
     # Perform prefetching of close to expired message cache entries
     # This only applies to domains that have been frequently queried
-    # NOTE: Disabled because prefetch doesn't work with subnet module (views)
     # see: https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html#unbound-conf-prefetch
-    prefetch: no
+    prefetch: yes
+    prefetch-key: yes
+
+    # RFC 8482: answer ANY queries with an empty response instead of recursing
+    deny-any: yes
 
     # Threads and cache slabs optimized for 4-core CPU
     num-threads: 4