diff --git a/salt/unbound/listen.conf b/salt/unbound/listen.conf
index 81c5669..100cca2 100644
--- a/salt/unbound/listen.conf
+++ b/salt/unbound/listen.conf
@@ -1,5 +1,8 @@
 server:
     interface: 0.0.0.0
-    interface: ::
     access-control: 172.20.72.0/21 allow
     access-control: 0.0.0.0/0 refuse
+    interface: ::
+    access-control: fd23:42:c3d2:500::/56 allow
+    access-control: ::172.20.72.0/117 allow
+    access-control: ::/0 deny
diff --git a/salt/unbound/root.conf b/salt/unbound/root.conf
new file mode 100644
index 000000000..5f96ea5
--- /dev/null
+++ b/salt/unbound/root.conf
@@ -0,0 +1,2 @@
+server:
+    root-hints: "/usr/share/dns/root.hints"