Trying to find out why my unbound will not resolve www.startpuntgeldzaken.nl

[Gerben Wierda]

What I see is this (reliably)

When asking 8.8.8.8 or 9.9.9.9 directly, the name is resolved.

But when unbound forwards to 8.8.8.8 or 9.9.9.9, it fails. 

In other words: I can realiable ask 9.9.9.9 for www.startpuntgeldzaken.nl but I cannot get unbound to get that same info via a forward. See:

$ unbound-control lookup www.startpuntgeldzaken.nl
The following name servers are used for lookup of www.startpuntgeldzaken.nl.
forwarding request:
Delegation with 0 names, of which 0 can be examined to query further addresses.
It provides 2 IP addresses.
9.9.9.9         	rto 103 msec, ttl 299, ping 35 var 17 rtt 103, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
149.112.112.112 	rto 92 msec, ttl 293, ping 28 var 16 rtt 92, tA 0, tAAAA 0, tother 0, EDNS 0 probed.

and

$ dig @9.9.9.9 www.startpuntgeldzaken.nl; dig @192.168.2.86 www.startpuntgeldzaken.nl

; <<>> DiG 9.10.6 <<>> @9.9.9.9 www.startpuntgeldzaken.nl
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62765
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;www.startpuntgeldzaken.nl.	IN	A

;; ANSWER SECTION:
www.startpuntgeldzaken.nl. 60	IN	CNAME	nibud.truepeople.space.
nibud.truepeople.space.	300	IN	CNAME	tp-nibud-01.truepeople.space.
tp-nibud-01.truepeople.space. 300 IN	A	84.22.99.176

;; Query time: 36 msec
;; SERVER: 9.9.9.9#53(9.9.9.9)
;; WHEN: Wed May 05 22:11:32 CEST 2021
;; MSG SIZE  rcvd: 132


; <<>> DiG 9.10.6 <<>> @192.168.2.86 www.startpuntgeldzaken.nl
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached

It is that reliable difference between asking 9.9.9.9 (or 8.8.8.8, or 1.1.1.1) directly and doing the same via unbound that forwards that bothers me. Direct always succeeds. Forward always fails.

Gerben