❯ cat /etc/unbound/unbound.conf.d/dot.conf 
server:
    tls-service-key: /etc/unbound/unbound_server.key
    tls-service-pem: /etc/unbound/unbound_server.pem
forward-zone:
    name: "."
    forward-ssl-upstream: yes
    # Digitalcourage
    forward-addr: 5.9.164.112@853#dns3.digitalcourage.de
    forward-addr: 2a01:4f8:251:554::2@853#dns3.digitalcourage.de
    # ffmuc.net
    forward-addr: 5.1.66.255@853#dot.ffmuc.net
    forward-addr: 2001:678:e68:f000::@853#dot.ffmuc.net
    forward-addr: 185.150.99.255@853#dot.ffmuc.net
    forward-addr: 2001:678:ed0:f000::@853#dot.ffmuc.net

❯ sudo unbound-host -C /etc/unbound/unbound.conf -v unbound.net                                                               
[1705752601] libunbound[851167:0] notice: init module 0: validator                                                            
[1705752601] libunbound[851167:0] notice: init module 1: iterator                                                             
[1705752601] libunbound[851167:0] error: no name verification functionality in ssl library, ignored name for 2001:678:ed0:f000
::@853#dot.ffmuc.net                                                                                                          
[1705752601] libunbound[851167:0] error: no name verification functionality in ssl library, ignored name for 185.150.99.255@85
3#dot.ffmuc.net                                                                                                               
[1705752601] libunbound[851167:0] error: no name verification functionality in ssl library, ignored name for 2001:678:e68:f000
::@853#dot.ffmuc.net                                                                                                          
[1705752601] libunbound[851167:0] error: no name verification functionality in ssl library, ignored name for 5.1.66.255@853#do
t.ffmuc.net                                                                                                                   
[1705752601] libunbound[851167:0] error: no name verification functionality in ssl library, ignored name for 2a01:4f8:251:554:
:2@853#dns3.digitalcourage.de
[1705752601] libunbound[851167:0] error: no name verification functionality in ssl library, ignored name for 5.9.164.112@853#d
ns3.digitalcourage.de
[1705752601] libunbound[851167:0] info: resolving unbound.net. A IN
[1705752601] libunbound[851167:0] error: read (in tcp s): Connection reset by peer for 2a01:4f8:251:554::2 port 853
[1705752601] libunbound[851167:0] error: read (in tcp s): Connection reset by peer for 2a01:4f8:251:554::2 port 853
[1705752601] libunbound[851167:0] error: read (in tcp s): Connection reset by peer for 5.9.164.112 port 853
[1705752601] libunbound[851167:0] error: read (in tcp s): Connection reset by peer for 5.9.164.112 port 853
[1705752601] libunbound[851167:0] error: read (in tcp s): Connection reset by peer for 5.9.164.112 port 853
[1705752601] libunbound[851167:0] error: read (in tcp s): Connection reset by peer for 2a01:4f8:251:554::2 port 853
[1705752601] libunbound[851167:0] error: read (in tcp s): Connection reset by peer for 5.9.164.112 port 853
[1705752601] libunbound[851167:0] error: read (in tcp s): Connection reset by peer for 2a01:4f8:251:554::2 port 853
[1705752602] libunbound[851167:0] error: read (in tcp s): Connection reset by peer for 5.9.164.112 port 853
[1705752602] libunbound[851167:0] error: read (in tcp s): Connection reset by peer for 2a01:4f8:251:554::2 port 853
Host unbound.net not found: 2(SERVFAIL). (error)

Version 1.13.1
Configure line: --build=x86_64-linux-gnu --prefix=/usr --includedir=${prefix}/include --mandir=${prefix}/share/man --infodir=${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=${prefix}/lib/x86_64-linux-gnu --libexecdir=${prefix}/lib/x86_64-linux-gnu --disable-maintainer-mode --disable-dependency-tracking --disable-rpath --with-pidfile=/run/unbound.pid --with-rootkey-file=/var/lib/unbound/root.key --with-libevent --with-libnghttp2 --with-pythonmodule --enable-subnet --enable-dnstap --enable-systemd --with-chroot-dir= --with-dnstap-socket-path=/run/dnstap.sock --libdir=/usr/lib
Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 3.0.2 15 Mar 2022
Linked modules: dns64 python subnetcache respip validator iterator
BSD licensed, see LICENSE in source package for details.
Report bugs to unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues