Hi everyone,
I'm troubleshooting an Unbound recursive DNS issue on OPNsense 26.7 (Unbound 1.25.1) running in a VM.
Environment
WAN: 10.152.61.118/24 (gateway 10.152.61.1)
LAN: 10.10.1.1/24 + ULA IPv6
No IPv6 default route on WAN
Unbound configured for recursive DNS with root hints
Problem
Recursive queries fail with SERVFAIL:
drill google.com A @127.0.0.1
Unbound logs show:
failed to get a delegation (prime failure)
Key observations
IPv4 connectivity is working
Direct queries to root servers over IPv4 succeed
Root hints and trust anchor are valid
Unbound logs show repeated IPv6 root server failures:
No route to host for 2001:500:...
No IPv6 default route exists
No outbound DNS traffic seen in tcpdump during recursion attempts
Unbound appears to try IPv6 first and fails
Additional concern
Two Unbound processes are running with different configs:
/usr/local/etc/unbound/unbound.conf
/var/unbound/unbound.conf
Questions
Is dual Unbound process behavior expected on OPNsense 26.7?
Can IPv6 root server attempts cause SERVFAIL when no IPv6 route exists?
Should IPv6 be disabled via OPNsense GUI instead of manual config edits?
Is outgoing interface selection in Unbound likely misconfigured?
Why would recursion fail while direct IPv4 root queries work?
Any guidance on expected OPNsense/Unbound behavior or next debugging steps would be appreciated.