Requirements:
  - unbound for dns from localhost
  - rspamd... maybe
  ...