diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf
index c9b01b8f4..3f724d8f7 100644
--- a/config/unbound/unbound.conf
+++ b/config/unbound/unbound.conf
@@ -42,6 +42,7 @@ server:
 	# Privacy Options
 	hide-identity: yes
 	hide-version: yes
+	qname-minimisation: yes
 	minimal-responses: yes
 
 	# DNSSEC
@@ -55,6 +56,7 @@ server:
 	harden-short-bufsize: no
 	harden-large-queries: yes
 	harden-dnssec-stripped: yes
+	harden-below-nxdomain: yes
 	harden-referral-path: yes
 	harden-algo-downgrade: no
 	use-caps-for-id: no