tls dot-local-tls {
        key-file "/etc/dot/dot.key";
        cert-file "/etc/dot/dot.pem";
};
tls doh-local-tls {
        key-file "/etc/doh/doh.key";
        cert-file "/etc/doh/doh.pem";
};

options {
        directory "/var/cache/bind";

        // If there is a firewall between you and nameservers you want
        // to talk to, you may need to fix the firewall to allow multiple
        // ports to talk.  See http://www.kb.cert.org/vuls/id/800113

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        // Uncomment the following block, and insert the addresses replacing
        // the all-0's placeholder.

        forwarders { 127.0.0.1 port 54;
         };

        //========================================================================
        // If BIND logs error messages about the root key being expired,
        // you will need to update your keys.  See https://www.isc.org/bind-keys
        //========================================================================
        dnssec-validation yes;
        listen-on port 53 { any; };
        listen-on-v6 port 53 { any; };
        recursion yes;
        allow-query { any; };
        listen-on port 853 tls dot-local-tls { any; };
        listen-on port 443 tls doh-local-tls http default {any;};
};

/etc/dot/** r,
/etc/doh/** r,

apparmor_parser -r /etc/apparmor.d/usr.sbin.named

service bind9 restart