+<% if not @firewall_blocks_dns %>
+ auto-trust-anchor-file: "/var/lib/unbound/29.172.in-addr.arpa.key"
+<% end -%>
+
+ prefetch: yes
+ prefetch-key: yes
+
+
+<% if not @firewall_blocks_dns %>
+local-zone: "29.172.in-addr.arpa" nodefault
+forward-zone:
+ name: "29.172.in-addr.arpa"
+ forward-host: geo1.debian.org
+ forward-host: geo2.debian.org
+ forward-host: geo3.debian.org
+<% end -%>