I'm trying to use DoT at home to protect my privacy and I'm using my own resolver hosted externally. The external resolver is Unbound 1.9 and my LAN resolver is Unbound 1.7.

With this combo random domains will fail a DS lookup even though they don't have DNSSEC. Causing them to fail the query from my home LAN. So direct queries to the external resolver always work, with or without dnssec. But internally on my LAN I get a failed query for some domains, seemingly at random.

I've seen one other post on the Cloudflare boards with someone having the exact same issue, otherwise nothing. And no replies on that post.

Only way to get rid of the intermittent issue is to disable upstream TLS.

Really sucks, anyone know more about this? My idea was maybe to run 1.9 in my LAN using containers, just to match up versions and exclude any such issues.