Paul Wouters: > service unbound start > dig +dnssec nohats.ca Paul, I could not reproduce unvalidated answers using unbound-1.4.21 Empty cache, first dig take 800ms. Second dig answered from cache, 2 ms both have AD bit set. Andreas