… If you have privacy concerns about logging your own DNS queries, disable it. 8. If you enabled logging, choose the privacy level for the logs. The default Show everything and record everything is fine for most home labs. …
… But if you travel a lot, use public Wi-Fi often, or want your traffic to exit from your home/business network, full tunnel is worth having available. DNS Matters Too One thing that gets overlooked with split-tunnel and full-tunnel VPNs is DNS. …
… If you use the default dns-root-data package, unbound will find it automatically root-hints: "/var/lib/unbound/root.hints" Trust glue only if it is within the server's authority harden-glue: yes Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS harden-dnss… …