diff --git a/build/unbound.conf b/build/unbound.conf
index 61867b1..ed761ac 100644
--- a/build/unbound.conf
+++ b/build/unbound.conf
@@ -33,6 +33,10 @@ server:
 	cache-min-ttl: 60
 	cache-max-ttl: 960
 	harden-glue: yes
+	aggresive-nsec: yes
+	serve-expired: yes
+	serve-expired:ttl 86400
+	serve-expired-ttl-reset: yes
 remote-control:
 	control-enable: yes
 	control-use-cert: no
@@ -47,3 +51,5 @@ forward-zone:
 	forward-addr: 78.47.220.84@853#b.cyberiadot.invalid
 	forward-addr: 2620:fe::fe@853#dns.quad9.net
 	forward-addr: 9.9.9.9@853#dns.quad9.net
+	forward-addr: 2606:4700:4700::1111@853#cloudflare-dns.com
+	forward-addr: 1.1.1.1@853#cloudflare-dns.com