diff --git a/config/unbound/unbound.conf b/config/unbound/unbound.conf
index 9d5e840dd..3848b0f71 100644
--- a/config/unbound/unbound.conf
+++ b/config/unbound/unbound.conf
@@ -40,6 +40,7 @@ server:
 	harden-large-queries: yes
 	harden-referral-path: yes
 	aggressive-nsec: yes
+	deny-any: yes
 
 	# TLS
 	tls-cert-bundle: /etc/ssl/certs/ca-bundle.crt