This may be something that is obvious or that is behaviour that is expected by Unbound. Here's my issue. I have two large-ish (rrset_cache set to 300MB) caches at the front of my network nearest the egress to the Internet. On a WAN at a stub office (with WiMax towers connected) is another network, which I set up unbound on as well and pointed at the caches at the front of the network using: forward-zone: name: "." forward-addr: 220.127.116.11 forward-addr: 18.104.22.168 The machine itself can resolve addresses using this configuration, but none of the systems on the network can resolve. Taking the forward-zone out, they resolve perfectly.