unwind.conf

# $OpenBSD: unwind.conf

# CIRA Canada Shield public DNS resolvers with privacy and optional DNS blocking lists
# https://www.cira.ca/cybersecurity-services/canadian-shield

# Macros

# Private (doesn't sell personal data)
v4ciradns3private="149.112.121.10 authentication name private.canadianshield.cira.ca DoT"
v6ciradns3private="2620:10A:80BB::10 authentication name private.canadianshield.cira.ca DoT"

# Private plus Protected (malware and phishing DNS blocking lists)
v4ciradns3protected="149.112.121.20 authentication name protected.canadianshield.cira.ca DoT"
v6ciradns3protected="2620:10A:80BB::20 authentication name protected.canadianshield.cira.ca DoT"

# Private plus Protected plus Family (pornographic content DNS blocking lists)
v4ciradns3family="149.112.121.30 authentication name family.canadianshield.cira.ca DoT"
v6ciradns3family="2620:10A:80BB::30 authentication name family.canadianshield.cira.ca DoT"

# Global Configuration

forwarder {
 $v4ciradns3private
 $v6ciradns3private
}

preference { DoT }