On Mon, Jul 13, 2026 at 07:28:03PM -0400, [email protected] wrote:
All of the commented lines belong in the "server:" section. As you have show here they are in the "forward-zone:" section, thus config errors. Either add a "server:" above the commented lines or move the lines.
Thank you for that. I was fixated on the "server:" section pertaining to local only. The unbound services LAN requests on the usual port then queries external dns on port 853. Unbound now loads without error. I still see tls1.2 in Client Hello though like this: %doas tshark -r tls-versions-test2.pcap -Y "tls" | ug 1.1.1.1 | ug TLSv1.2 2: 1223 19.590482 192.168.1.199 → 1.1.1.1 TLSv1.2 131 Client Hello I'm thinking I maybe need to rebuild libressl without tls1.2 or sni, or install libressl-portable with those options negated. What do you think? --
