Hi, I am trying to setup unbound as the default nameserver within the Stichting Wireless Leiden Community network, yet I am getting amplification issues when querying domains with SERVFAIL responses. I am using 'test123456789.nl' as example domain (if somebody knows the official 'SERVFAIL' test server, I would be happy). The setup consist of 20+ edge-nodes (those have an internet connection) which provide recursive DNS services and are configured like this: forward-zone: name: '.' forward-addr: 18.104.22.168 forward-addr: 22.214.171.124 (Using the vanilla config of dns/unbound port of FreeBSD as base). Secondly I have access-nodes (those without internet connection), which are configured like this: forward-zone name: '.' forward-addr: 172.31.254.1 forward-addr: 172.31.254.2 forward-addr: 172.31.254.3 ...<snip>... forward-addr: 172.31.254.48 forward-addr: 172.31.254.49 forward-addr: 172.31.254.50 All nodes together make up an distributed network, due to the resilience and the nature of the network the access-node indeed has 50 forwarders configured  When I issue a request against an access-node, itself will query the fastest 'edge-node', since it will receive an SERVFAIL as response, it will continue to query the second, and the third, the forth,.... Meaning my single request gets asked to all 'edge-nodes' of which all of them which all test same question to its uplink providers. This amplication is a real problem, since we have seen viruses on client-devices which basically act like this: sh -c 'for N in $(seq 0 10000); do echo drill a$N.test123456789.nl @127.0.0.1 \& ; done' | sh -x Any pointers in how-to limit this amplification behaviour without scrubbing the forwarders list? Best regards, /Rick van der Zwet  FYI: Previously I used with BIND an small homebrew tool to reshuffle the /etc/resolv.conf as such that the fastest DNS server was listed first, how-ever I rather like to use unbound, since it much more memory friendly and also has the ability to deal with this kind of optimization much smarter itself, in which at first glance indeed seems to be the case.