On Jun 3, 2016, at 12:30 PM, Benny Pedersen <m...@junc.eu> wrote: > dig +trace ipv4.google.com > > if the first hop in dns is 127.0.0.1 it works
that's not how +trace works from the manpage: When tracing is enabled, dig makes iterative queries to resolve the name being looked up. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup. If @server is also specified, it affects only the initial query for the root zone name servers. > make sure /etc/resolv.conf only have one single line with nameserver > 127.0.0.1 nothing more nothing less good advise. > drop unbound if it cant make it right, replace it with bind9 either works fine if configured correctly (and not so well if configured incorrectly). -- Daniel J. Luke