Update: Unbound is actually not forwarding at all. On the local machine I had my resolver set to 127.0.0.2 so it went directly to dnscrypt-proxy. Changing resolv.conf back to 127.0.0.1 results in all requests going through the normal lookup process, not to dnscrypt-proxy. I have even tried now with the recommended setup on the dnscrypt.org page running dnscrypt on 127.0.0.1:40 and this unbound conf: server: access-control: 10.0.1.0/24 allow logfile: "/var/log/unbound.log" log-time-ascii: yes module-config: "iterator" do-not-query-localhost: no forward-zone: name: "." forward-addr: 127.0.0.1 at 40 forward-first: no -----again, my version info is: Unbound 1.4.19 running on Ubuntu 13.04 server------ Any suggestions? Thank you.