Two things:
- The 'serve-expired-client-timeout:' has no support for the subnet
module. That means that when the client timeout is reached, Unbound
will try to find an (expired) answer in the *global* cache and reply
to the client(s).
- The subnet module has no support for expired answers.
(I believe we need startup warnings and cleaner documentation for those)
So if your answers are stored in the ECS cache, serve-expired logic will not be able to find them.
If your answers are stored in the global cache (because based on your configuration the upstream has no support for ECS) then serve-expired logic will be able to find them after the serve-expired-client-timeout.