Hi, I have the same behavior.
My intention was to use 1.1.1.1@853 as main forwarder, and fallback to recursive lookups via root server. Unfortunately recursive lookups don't' work while I have "forward-ssl-upstream: yes". --- forward-zone: name: "." forward-addr: 1.1.1.1@853 forward-ssl-upstream: yes forward-first: yes root-hints: /etc/unbound/root.hints --- Ubuntu 18.04.3 Unbound 1.6.7 DiG 9.11.3
