I have used pi-hole recommended config. I have used unbound recommended config (which feels incomplete and confusing). I have tried tweaks here and there. End result is this.

So far, the longest I have had success is with unbound docker container. The issue with that is that it seems to not be caching entries.

I used a similar docker compose config. Yesterday I learned that unbound doesn’t have root.hints by default. I downloaded it following Anudeep’s guide on Github and it was working. But within 2 hours, it started taking too long to respond and eventually stopped replying to pihole. I had to switch to cloudflare.

I tried again today with baremetal and docker install but I always end up with SERVFAIL after some time.

You seem knowledgeable. I have a question about this. I have ran this type of setup before. Every time, I ended up ditching unbound because it throws DNSSEC error. I have tried troubleshooting but it doesn’t work.