. {
    # Cache responses (success and denial)
    cache {
        success 9984 300 3600
        denial 9984 60 300
        prefetch 10 1m 10%
    }

    # Forward to upstream DNS (Charter first, then public)
    forward . 24.166.11.3 24.166.11.6 1.1.1.1 8.8.8.8 {
        policy sequential
        health_check 30s
    }

    # Log errors only
    errors

    # Limit concurrent connections
    bufsize 1232
}