diff --git a/unbound.conf b/unbound.conf
index bf2924f..7f07dce 100644
--- a/unbound.conf
+++ b/unbound.conf
@@ -6,7 +6,9 @@ server:
     prefetch-key: yes
     qname-minimisation-strict: yes
     hide-identity: yes
+    hide-trustanchor: yes
     hide-version: yes
+    harden-large-queries: yes
     outgoing-port-permit: 1024-65535
     outgoing-port-avoid: 7275 # supl
     outgoing-port-avoid: 8008 # synapse