« the DNS lookup tool "dig" has a very useful feature to trace the DNS delegation from the root-DNS down to the requested domain name. Such a trace looks like this:

% dig menandmice.com +trace

[...]

If the  DNS resolver configured in the operating system where "dig +trace" is uses is a unbound DNS Server, the "+trace" function might fail: [...] The reason for this is that dig sends the very first query for the list of root-dns servers as an iterative query to the local resolving DNS Server. An iterative query is a query where the RD-Flag in the DNS query package is not set (RD=recursion desired). Iterative queries are usually used between a resolving DNS Server and an authoritative DNS Server. Client systems send recursive queries (RD flag set= recursion desired). Unbound is a recursive DNS Server, and it is build to answer recursive queries, not iterative queries (it is not an authoritative DNS Server). In the default configuration, unbound will refuse an iterative query:

[...]

It is possible to use "dig +trace" by specifying one of the root-DNS servers for the initial query:

dig menandmice.com +trace @a.root-servers.net

However for users of unbound that do not want to miss the "+trace" function of dig can configure unbound in a way that it allows iterative (no-recursive) queries. This is done by using the "allow_snoop" option in the access-control statement: »

Via https://twitter.com/aeris22/status/691267904600432640