Having setup DoT and got it all working, I was under the impression
that all DNS queries would now use TLS over TCP.
Where? Between your client and your unbound recursor (where you have
control and can enable DNS-over-TLS-over-TCP), or outwards from your
unbound recursor to the rest of the net? For the latter to work, each
and every publishing name server out there would have to have deployed
DNS-over-TLS-over-TCP. To put it mildly, "we're not there yet", and
I'm doubtful we ever will be.
Even if you dropped "TLS", and only wanted to do TCP, I think that
would also work poorly, since still too many publishing name servers
either don't do DNS-over-TCP or there are firewalls on the path which
prohibit it from working.
Havard is right about the DNS ecosystem and the use of UDP.
However I want to clarify the unbound behavior in regards to what you
are trying to do:
Setting `do-udp: no` will disable UDP for unbound all together. That
means both upstream and downstream communication.
You can verify that by running the same dig commands but with the extra
`+tcp` option. This will force dig to use TCP to unbound and unbound
will answer normally.
Although you will get an answer because you forced your client to
connect via TCP, this cannot be guaranteed by other clients on your
system. That's why I don't advise on having `do-udp: no`.
From your configuration you should have something like
If you don't have any other conflicting forward-zone or stub-zone
directives then all your upstream traffic goes to the defined DNS
servers above over TLS over TCP.
The only other caveat is the use of `forward-first: yes` inside
`forward-zone`. In your case you shouldn't use it because what it tries
to do is first try to get an answer from the configured dns resolver and
if that fails it falls back to it's own resolution.
There are no other DNS servers that rely on this one for any services
whatsoever its 100% standalone.
All queries to the internet go via the forward server which supports DoT so
that should be doing the donkeywork to the wider internet and returning the
results. Unbound from the log file does many queries to that server (all
using TLS authenticated over TCP) to gather all the information it requires
to either return the queried name as either insecure or if it has been
signed it checks that the signature can be validated.
If DNSSEC fails you get a SRVFAIL an no useful data returned (e.g. no IP
address in the A or AAA record)
If its not been signed you get the data whatever, its then up to you if you
think where you are sent is valid (e.g. when using a browser)
So at this point I can't see where UDP would be used? As far as I can see
there are no queries that go to other servers on the internet that are NOT
those defined in the forward list.