Software
Unbound website

oisd links
https://big.oisd.nl/rpz This list might be too big.
https://small.oisd.nl/rpz
https://nsfw.oisd.nl/rpz This list might be too big.
https://nsfw-small.oisd.nl/rpz

Note: Automatic updates: Yes, with RPZ. Unbound refreshes the feed using its SOA refresh interval (currently 24 hours). No separate download cron job is needed.

how to
RPZ setup

1. Requires Unbound 1.10.0 or newer with the respip module. Check your version with unbound -V. Upgrade first if you are using an older version.
2. Merge this example into your Unbound configuration. The CA bundle path is for Debian/Ubuntu; adjust it for your system and ensure it is accessible inside any Unbound chroot.

   server:
       module-config: "respip validator iterator"
       tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"
   
   rpz:
       name: "oisdbig"
       url: "https://big.oisd.nl/rpz"

   If you already have module-config, add respip at the front while preserving your other modules. Keep existing DNSSEC trust-anchor settings and any working tls-cert-bundle setting. The rpz: block is a top-level section.
3. Optionally add adult-site blocking:

   rpz:
       name: "oisdnsfw"
       url: "https://nsfw.oisd.nl/rpz"

   For smaller lists, substitute https://small.oisd.nl/rpz or https://nsfw-small.oisd.nl/rpz respectively. Each RPZ section needs a unique name.
4. Run unbound-checkconf (with your configuration path if non-default), then reload Unbound using your system service manager. Check its logs to confirm successful feed loading.

These examples keep feeds in memory and fetch them again on startup. For a persistent copy, add zonefile: to each RPZ section with a distinct path writable by Unbound, accounting for chroot and service sandbox restrictions.

When migrating, remove the old OISD local-zone include and its download job after confirming RPZ works. Existing local-zone rules take precedence over RPZ.

See the official Unbound RPZ guide and configuration reference.