Of the three authoritative servers, ns21.kpmedia.org is responding with a REFUSED response.
$ dig www.heroesonline.com @ns21.kpmedia.org ; <<>> DiG 9.10.6 <<>> www.heroesonline.com @ns21.kpmedia.org ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 506 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.heroesonline.com. IN A ;; Query time: 348 msec ;; SERVER: 37.61.235.107#53(37.61.235.107) ;; WHEN: Wed May 01 20:40:38 PDT 2019 ;; MSG SIZE rcvd: 49 So 33% of lookups will fail. It is possible that Google retries different NS servers, if a REFUSED is received. Or perhaps they hit the two working servers, and are just returning the cached result. Either way, this is not specifically an Unbound issue, as the REFUSED behaviour can be seen anywhere on the Internet. > On May 1, 2019, at 1:14 PM, Todd Blake via Unbound-users > <[email protected]> wrote: > > heroesonline.com <http://heroesonline.com/> name server ns21.kpmedia.org > <http://ns21.kpmedia.org/>. > heroesonline.com <http://heroesonline.com/> name server ns19.kpmedia.org > <http://ns19.kpmedia.org/>. > heroesonline.com <http://heroesonline.com/> name server ns20.kpmedia.org > <http://ns20.kpmedia.org/>. > root@stretch:~# host ns21.kpmedia.org <http://ns21.kpmedia.org/>. 8.8.8.8 > Using domain server: > Name: 8.8.8.8 > Address: 8.8.8.8#53 > Aliases:
