server:

    #----------------------------------------
    # Upstream Server Connections Settings
    #----------------------------------------

    # upstream connections use TCP only (and no UDP), "yes" or "no"
    # useful for tunneling scenarios, 
    # Default is no.
    #tcp-upstream: no

    # Enable udp upstream even if do-udp is no. This does not change anything.
    # Useful for TLS service providers, that want no udp downstream but use udp to
    # fetch data upstream. 
    # Default is no.
    #udp-upstream-without-downstream: no

    # Enabled or disable whether the upstream queries use TLS only for transport.
    # Useful in tunneling scenarios. The TLS contains plain DNS in TCP wireformat. The
    # other server must support this (see tls-service-key). If you enable this, also
    # configure a tls-cert-bundle or use tls-win-cert to load CA certs, otherwise the
    # connections cannot be authenticated. This option enables TLS for all of them,
    # but if you do not set this you can configure TLS specifically for some forward
    # zones with forward-tls-upstream. And also with stub-tls-upstream.
    # Default is no.
    #tls-upstream: <yes or no>
