<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>I've spent several hours trying various permutations of the
following config, but no matter what I do I can't get unbound to
forward a DNS request over TLS:</p>
<p><font face="Consolas" color="#006600">server:<br>
tls-cert-bundle: "C:\Program Files\Unbound\cabundle.crt"<br>
forward-zone:<br>
name: "."<br>
forward-ssl-upstream: yes<br>
forward-addr: <a class="moz-txt-link-abbreviated" href="mailto:1.1.1.1@853#cloudflare-dns.com">1.1.1.1@853#cloudflare-dns.com</a></font></p>
<p>I'm on windows 10, unbound v1.7.1. I've been using nslookup to
test:</p>
<p><font color="#006600">C:\Users\Me>nslookup - 127.0.0.1<br>
Default Server: localhost<br>
Address: 127.0.0.1<br>
<br>
> google.com<br>
Server: localhost<br>
Address: 127.0.0.1<br>
<br>
*** localhost can't find google.com: Server failed<br>
></font><br>
</p>
<p>Following this request in wireshark, unbound is accurately
requesting DNS to the cloudflare server on tcp port 853, but is
attempting to do this without negotiating a TLS connection, which
cloudflare appropriately rejects.<br>
</p>
<p>Anyone have any ideas?<br>
</p>
<font color="#009900"><font face="Consolas"></font></font>
</body>
</html>