anchor.diff:    # Default on, which insists on dnssec data for trust-anchored zones.
     # harden-dnssec-stripped: yes
   
  -        # Harden the referral path by performing additional queries for
  +  # Harden the referral path by performing additional queries for
     # infrastructure data.  Validates the replies (if possible).
     # Default off, because the lookups burden the server.  Experimental 
     # implementation of draft-wijngaards-dnsext-resolver-side-mitigation.
  
positive.code: 
    # number of ports to allocate per thread, determines the size of the
    # port range that can be open simultaneously. 
    outgoing-range: 32768
  
    # permit unbound to use this port number or port range for
    # making outgoing queries, using an outgoing interface.
  
negative.code:   # msg-cache-slabs: 4
  
    # the number of queries that a thread gets to service.
    num-queries-per-thread: 40000
  
    # if very busy, 50% queries run to completion, 50% get timeout in msec
    # jostle-timeout: 200
  
    # the amount of memory to use for the RRset cache.
    # plain value in bytes or you can append k, m or G. default is "4Mb". 
    rrset-cache-size: 4G
  
    # the number of slabs to use for the RRset cache.
    # the number of slabs must be a power of 2.
  