diff --git a/salt/unbound/forward.conf b/salt/unbound/forward.conf
index 56d8882..3bb31b4 100644
--- a/salt/unbound/forward.conf
+++ b/salt/unbound/forward.conf
@@ -1,3 +1,7 @@
+server:
+        # DNS-over-TLS
+        ssl-upstream: yes
+
 forward-zone: 
         name: "." 
 	forward-addr: 9.9.9.9@853         # quad9.net primary