Unbound lets you forward queries to nameservers matched by the query (sub-)domain. *.internal queries can be sent to the local nameserver, for example, while o

Unbound lets you forward queries to nameservers matched by the query (sub-)domain. *.internal queries can be sent to the local nameserver, for example, while others can be forwarded to the public nameserver. Minimal unbound.conf example: forward-zone: name: "." forward-addr: 1.1.1.1 forward-zone: name: "internal" forward-addr: 10.0.0.1 Unbound also supports DNS-over-TLS, although stubby's implementation is much better. It's usually ideal to forward to a local stubby instance instead.