diff --git a/unbound.conf b/unbound.conf
index 755d4b0..24dd10e 100644
--- a/unbound.conf
+++ b/unbound.conf
@@ -12,6 +12,9 @@ include: "/etc/unbound/unbound.conf.d/*.conf"
 server:
   hide-version: yes
 
+  # Disable ANY records due to DDoS
+  deny-any: yes
+
   interface: 127.0.0.1
   interface: ::1