On 2026-07-14 13:14:49, "void" wrote: >On Mon, Jul 13, 2026 at 07:28:03PM -0400, obsd()mulh.net wrote: > >>All of the commented lines belong in the "server:" section. >>As you have show here they are in the "forward-zone:" section, thus config >>errors. >>Either add a "server:" above the commented lines or move the lines. > >Thank you for that. I was fixated on the "server:" section pertaining >to local only. The unbound services LAN requests on the usual port then >queries external dns on port 853. Unbound now loads without error. > >I still see tls1.2 in Client Hello though like this: > >%doas tshark -r tls-versions-test2.pcap -Y "tls" | ug 1.1.1.1 | ug TLSv1.2 >2: 1223 19.590482 192.168.1.199 .. 1.1.1.1 TLSv1.2 131 Client Hello
Looking back at your configuration and at the unbound.conf documentation, https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html I don't see "tls-version:" as a valid option (maybe an alias for tls-protocols?). The valus for tls-protocols: should be quoted, ex: "TLSv1.3. You can also use "unbound-control get_option tls-protocols" to see current setting. In any case setting/changing this value requires fully restarting the service for the change to take effect. (for me, I'd just do a "rcctl reload unbound")
