diff --git a/etc/unbound/unbound.conf.d/dns-mullvad.conf b/etc/unbound/unbound.conf.d/dns-mullvad.conf
new file mode 100644
index 00000000..ee46714e
--- /dev/null
+++ b/etc/unbound/unbound.conf.d/dns-mullvad.conf
@@ -0,0 +1,13 @@
+# WARNING! This is unencrypted DNS, you don't want this outside of using
+# Mullvad's VPN.
+
+forward-zone:
+    name: "."
+
+    # Mullvad Wireguard
+    forward-addr: 10.64.0.1
+    # Mullvad OpenVPN "(or any other address matching 10.x.0.1)"
+    forward-addr: 10.8.0.1
+
+    # Mullvad’s own public, non-logging DNS server.
+    forward-addr: 193.138.218.74