Dear Maintainer, I run dnsmasq :53 in front of unbound :5353, and: $ read -r uuid < /proc/sys/kernel/random/uuid $ dig a $uuid.host ;; ->>HEADER<<- opcode: QUERY; status: NXDOMAIN; id: 35035 ;; Flags: qr rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 1; ADDITIONAL: 0 ;; QUESTION SECTION: ;; 2a5630ac-12ac-46fa-b4c7-1fcdddfc2f8b.host. IN A ;; AUTHORITY SECTION: host. 3600 IN SOA ns0.centralnic.net. hostmaster.centralnic.net. 3000457776 900 1800 6048000 3600 ;; Received 124 B ;; Time 2023-09-09 02:07:26 CEST ;; From 127.0.0.1@53(UDP) in 84.1 ms $ dig a $uuid.host ;; ->>HEADER<<- opcode: QUERY; status: NXDOMAIN; id: 1526 ;; Flags: qr rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 0; ADDITIONAL: 0 ;; QUESTION SECTION: ;; 2a5630ac-12ac-46fa-b4c7-1fcdddfc2f8b.host. IN A ;; Received 59 B ;; Time 2023-09-09 02:07:29 CEST ;; From 127.0.0.1@53(UDP) in 0.3 ms $ dig a $uuid.host ;; ->>HEADER<<- opcode: QUERY; status: NXDOMAIN; id: 33318 ;; Flags: qr rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 0; ADDITIONAL: 0 ;; QUESTION SECTION: ;; 2a5630ac-12ac-46fa-b4c7-1fcdddfc2f8b.host. IN A ;; Received 59 B ;; Time 2023-09-09 02:07:32 CEST ;; From 127.0.0.1@53(UDP) in 0.3 ms Which is. Probably not right? Asking for SOA explicitly works: $ dig soa $uuid.host ;; ->>HEADER<<- opcode: QUERY; status: NXDOMAIN; id: 20830 ;; Flags: qr rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 1; ADDITIONAL: 0 ;; QUESTION SECTION: ;; 2a5630ac-12ac-46fa-b4c7-1fcdddfc2f8b.host. IN SOA ;; AUTHORITY SECTION: host. 3581 IN SOA ns0.centralnic.net. hostmaster.centralnic.net. 3000457776 900 1800 6048000 3600 ;; Received 124 B ;; Time 2023-09-09 02:07:46 CEST ;; From 127.0.0.1@53(UDP) in 26.5 ms And unbound behaves correctly here: $ dig -p 5353 a $uuid.host ;; ->>HEADER<<- opcode: QUERY; status: NXDOMAIN; id: 33325 ;; Flags: qr rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 1; ADDITIONAL: 0 ;; QUESTION SECTION: ;; 2a5630ac-12ac-46fa-b4c7-1fcdddfc2f8b.host. IN A ;; AUTHORITY SECTION: host. 3462 IN SOA ns0.centralnic.net. hostmaster.centralnic.net. 3000457776 900 1800 6048000 3600 ;; Received 124 B ;; Time 2023-09-09 02:09:45 CEST ;; From 127.0.0.1@5353(UDP) in 0.3 ms $ dig -p 5353 a $uuid.host ;; ->>HEADER<<- opcode: QUERY; status: NXDOMAIN; id: 11425 ;; Flags: qr rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 1; ADDITIONAL: 0 ;; QUESTION SECTION: ;; 2a5630ac-12ac-46fa-b4c7-1fcdddfc2f8b.host. IN A ;; AUTHORITY SECTION: host. 3462 IN SOA ns0.centralnic.net. hostmaster.centralnic.net. 3000457776 900 1800 6048000 3600 ;; Received 124 B ;; Time 2023-09-09 02:09:45 CEST ;; From 127.0.0.1@5353(UDP) in 0.3 ms $ dig -p 5353 soa $uuid.host ;; ->>HEADER<<- opcode: QUERY; status: NXDOMAIN; id: 47525 ;; Flags: qr rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 1; ADDITIONAL: 0 ;; QUESTION SECTION: ;; 2a5630ac-12ac-46fa-b4c7-1fcdddfc2f8b.host. IN SOA ;; AUTHORITY SECTION: host. 3458 IN SOA ns0.centralnic.net. hostmaster.centralnic.net. 3000457776 900 1800 6048000 3600 ;; Received 124 B ;; Time 2023-09-09 02:09:49 CEST ;; From 127.0.0.1@5353(UDP) in 0.4 ms So this is a............. dnsmasq cache-hit thing? Best, наб