[Unbound-users] DNSSEC problems

[Jan-Piet Mens]

(Your root.key is probably fine as it contains a DS RR which is
allowed.)

I reviewed your config again and detected you are forwarding the root
zone. 

> forward-zone:
>   name: "."
>   forward-addr: 127.0.0.1 at 53

I think you'll have to add something like this:

        local-zone: 127.in-addr.arpa. nodefault

"nodefault" is used to turn off default contents for AS112 zones. 

        -JP