Clean deploy notes. Two things I verify before pointing LAN clients at Unbound: DNSSEC failure mode and listening scope. If validation is on and a middlebox or upstream forwarder strips RRSIG, resolvers start returning SERVFAIL for otherwise fine names — looks like “the internet is down” to users. I test known good signed zones and one deliberately broken name, and I keep logs for validation failures during the first week.

Also bind carefully: listening on 0.0.0.0 without access-control turns a recursive resolver into an open relay. Prefer the LAN interface, allow only RFC1918 source nets, and rate-limit. When Unbound sits beside nginx on the same VPS, make sure nothing else owns :53 (systemd-resolved stub is a frequent conflict on Ubuntu). After cutover I compare query latency and cache hit ratio for a day before raising msg-cache-size; bigger cache helps, but wrong ACLs hurt first.