## resolve emerdns
coin.:53, emc.:53, lib.:53, bazar.:53, enum.:53 {
  cache 300
  forward . 10.5.0.9:5335
}

## Resolve .meshname and .popura domains with the meshname protocol
meshname.:53, popura.:53 {
  acl {
    allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
    block
  }
  meshname
  cache 300
}

## Example .popura domain hosting with a simple /etc/hosts like config
#aiql7yv7ka6ck5mxpfnugi3hoe.popura {
#    hosts {
#     220:bfe2:bf50:3c25:7597:795b:4323:6771 aiql7yv7ka6ck5mxpfnugi3hoe.popura
#     320:bfe2:bf50:3c25::f                  lofi.aiql7yv7ka6ck5mxpfnugi3hoe.popura
#    }
#}

## Example .popura domain hosting with file plugin.
## (Zone data is in RFC 1035-style master file)
#aiql7yv7ka6ck5mxpfnugi3hoe.popura {
#    file /etc/coredns/example.zonefile
#}

## Example .meship support
meship {
  meship
  cache 300
}

## Resolve Alfis domains
anon.:53, btn.:53, conf.:53, index.:53, merch.:53, mirror.:53, mob.:53, screen.:53, srv.:53, ygg.:53 {
  acl {
    allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
    block
  }
#  forward . [302:db60::53]:53 [300:6223::53]:53 [302:7991::53]:53
  cache 300
  forward . 10.5.0.3:53
}

## Onion (.onion) DNS resolution via Tor's DNSPort
onion.:53 {
  acl {
    allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
    block
  }
  # tor container listens on 9053 for DNS queries
  cache 300
  forward . 10.5.0.7:9053
}

## i2p domain resolution via local i2pdns bridge service
i2p.:53 {
  acl {
    allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
    block
  }
  cache 300
  # i2pd currently has no DNS listener; use local i2pdns bridge service.
  forward . 10.5.0.16:53
}

## Ethereum Name Service (ENS) via local ENS DNS microservice
eth.:53 {
  acl {
    allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
    block
  }
  cache 300
  forward . 10.5.0.11:53
}

## Namecoin (.bit) - privacy-preserving DNS
bit.:53 {
  acl {
    allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
    block
  }
  cache 300
  forward . 10.5.0.12:53
}

## Alternative DNS root (.alt) - local-only fallback
alt.:53 {
  acl {
    allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
    block
  }
  cache 300
  forward . 10.5.0.5:53
}

## Lokinet (.loki) - privacy network namespace
loki.:53 {
  acl {
    allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
    block
  }
  cache 300
  forward . 10.5.0.14:53
}

## Zilliqa blockchain (.zil)
zil.:53 {
  acl {
    allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
    block
  }
  cache 300
  forward . 10.5.0.15:53
}

## Web3 generic blockchain namespace (.web3)
web3.:53 {
  acl {
    allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
    block
  }
  cache 300
  forward . 10.5.0.5:53
}

## Tor-specific TLDs (.exit, .onion4, .onion6)
exit.:53, onion4.:53, onion6.:53 {
  acl {
    allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
    block
  }
  cache 300
  forward . 10.5.0.7:9053
}

## Resolve OpenNIC domains
bbs.:53, chan.:53, cyb.:53, dyn.:53, epic.:53, geek.:53, gopher.:53, indy.:53, libre.:53, neo.:53, null.:53, o.:53, oss.:53, oz.:53, parody.:53, pirate.:53, fur.:53, ku.:53, te.:53, ti.:53, uu.:53, ko.:53, rm.:53 {
  acl {
    allow net 100.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ::1/128 fc00::/7 200::/7
    block
  }
  cache 300
  forward . 10.5.0.5:53
}

## Resolve legacy centralized Internet domains
# this is the “catch‑all” zone.  recursion is no longer restricted by ACL;
# any client may perform lookups.  the previous ACL has been removed so that
# the service behaves like an ordinary recursive resolver.  keep an eye on
# performance if you expose this to untrusted networks.
.:53 {
  hosts {
    fallthrough
  }

  cache 300

  ## Resolve all other DNS queries via AdGuard with DNS-over-TLS encryption
#  forward . tls://94.140.14.14:853 tls://94.140.15.15:853 {
#    tls_servername dns.adguard.com
#    health_check 5s
#  }

  ## Forward to unencrypted DNS servers
  #forward . [324:71e:281a:9ed3::53]:53 [302:db60::53]:53 [300:6223::53]:53 [325:5a4:d1c9:db96::53]:53
  #forward . 1.1.1.1:53 8.8.8.8:53
#  forward . 138.197.140.189 147.93.130.20 168.235.111.72 162.243.19.47
  # Forward to local unbound recursive server
  forward . 10.5.0.5:53
}