<html><head></head><body><div>Hi,</div><div><br></div><div>I'm new to unbound and running it on opnsense.</div><div><br></div><div>I'm migrating to unbound for my home network which also contains a lab environment for my work.</div><div><br></div><div>I have multiple labs and ages ago chose the 'test' TLD for all of them. For example, if I'm running a lab for Server 2019, I'd give it the domain `w2k19.test` while a lab for Server 2016 would be `w2k16.test`. I had this working well with the technitium DNS server as I made the server authoritative for the test TLD and used either stub zones or forwards for each lab subdomain (either worked). I'm trying to replicate this in unbound.</div><div><br></div><div>I set forwards up for this:</div><div><br></div><div>forward-zone:</div><div> name: "w2k19.test"</div><div> forward-addr: <a href="mailto:172.28.131.10@53">172.28.131.10@53</a></div><div><br></div><div>To get this to work with unbound, I had to override the default where all `test` domains are blocked. I did this with:</div><div><br></div><div>local-zone: "test." transparent</div><div><br></div><div>This works if I query unbound for a server within the w2k19 lab (e.g. dc1.w2k19.test returns a record).</div><div><br></div><div>However, if I misspell the domain part (e.g. query dc1.w2k18.test), unbound sends the query to the internet (due to the local-zone above).</div><div><br></div><div>Is there a way to configure this, such that forward-zones are processed, but queries that would be sent to the root (for `test`) are blocked instead? forward-first and forward-no-cache looked promising at first, but didn't help.</div><div><br></div><div>Thanks in advance,</div><div><br></div><div>Gareth</div><div><span></span></div><div><br></div><div><span></span></div></body></html>