You can also configure unbound to prefetch records that are about to expire that the user has recently requested. This can reduce human pattern recognition and

You can also configure unbound to prefetch records that are about to expire that the user has recently requested. This can reduce human pattern recognition and correlation. Do this on your upstream servers as well. Read up on "target-fetch-policy:" Unbound also allows you to set a min-ttl, which is taboo in the DNS admin realm, but very useful for adding a small amount of privacy, at the risk of poorly engineered websites being unreachable for a small period of time. See "cache-min-ttl:" Consider keeping that under 20 minutes. I also log all query responses, then sort by request count and do additional prefetching of names I use, plus batches of random domain names to add some noise as others suggested. "log-queries: no" and "log-replies: yes". Logging this data can also help you spot websites that try to enumerate a users DNS and real IP by using unique A records per client. Also make sure you don't have the "subnetcache" module loaded, as it will by default send client-subnet data, allowing enumeration of your private network.