Bug when blocking tiktok.com, sometimes www.tiktok.com resolves and other times it does not.

Updating the block list, first remove existing block list.
unbound-control list_local_zones | grep -E 'always_(null|nx)' | awk '{print $1}' > unbound-local-zones.txt
unbound-control local_zones_remove < unbound-local-zones.txt

Then load updated block list:
unbound-control local_zones < blocklists-local-zone.txt

This command should produce this:
host www.tiktok.com
Host www.tiktok.com not found: 3(NXDOMAIN)

instead I get this:
host www.tiktok.com
www.tiktok.com is an alias for www.tiktok.com.edgesuite.net.
www.tiktok.com.edgesuite.net is an alias for a2047.api10.akamai.net.
a2047.api10.akamai.net has address 23.47.52.146
a2047.api10.akamai.net has address 23.47.52.148
a2047.api10.akamai.net has address 23.47.52.147
a2047.api10.akamai.net has address 23.47.52.145
a2047.api10.akamai.net has address 23.47.52.141
a2047.api10.akamai.net has address 23.47.52.142
a2047.api10.akamai.net has address 23.47.52.149
a2047.api10.akamai.net has address 23.47.52.140
a2047.api10.akamai.net has address 23.47.52.143

Work arounds, restarting unbound which loads local-zone blocks or
adding www.tiktok.com to the blocklist.

System
Unbound 1.19.1
Gentoo Linux

Version 1.19.1

Configure line: --prefix=/usr --build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --datarootdir=/usr/share --disable-static --docdir=/usr/share/doc/unbound-1.19.1 --htmldir=/usr/share/doc/unbound-1.19.1/html --with-sysroot=/ --libdir=/usr/lib64 --disable-debug --disable-gost --disable-dnscrypt --disable-dnstap --enable-ecdsa --disable-subnet --enable-cachedb --disable-static --disable-systemd --without-pythonmodule --without-pyunbound --with-pthreads --with-libnghttp2 --enable-tfo-client --enable-tfo-server --disable-flto --disable-rpath --enable-event-api --enable-ipsecmod --with-libevent=/usr --with-libhiredis=/usr --with-pidfile=/run/unbound.pid --with-rootkey-file=/etc/dnssec/root-anchors.txt --with-ssl=/usr --with-libexpat=/usr
Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 3.0.13 30 Jan 2024
Linked modules: dns64 cachedb ipsecmod respip validator iterator
TCP Fastopen feature available

BSD licensed, see LICENSE in source package for details.
Report bugs to unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues