Strange failure on XN--MGBA3A4F16A.

[John Levine]

I'm running unbound 1.9.1 from the FreeBSD package.  I have dnssec
validation turned on.

When I try to look up the XN--MGBA3A4F16A. TLD, after a delay I get
SERVFAIL.  I'm using a local root served by NSD which handles the
query without trouble.  I turned off the local root, same problem.

This happens to be the IDN version of .ir which resolves without
trouble.  Public resolvers like 8.8.8.8 resolve it too.

Any suggestions?

(In case you were wondering, I ran a script which checks the NS records
of every TLD that's supposed to be in the root, and I found that one
and only that one failed.)