« You might want to use an open recursive DNS servers if your ISP's DNS server is lying. However, if your network/ISP is intercepting all DNS requests, a standard open recursive DNS server won't help. You might have more luck by using an alternative port or by forcing the usage of TCP (use-vc option in recent versions of glibc) but it might not work. Alternatively, you could want to talk to a (trusted) remote recursive DNS server over secure channel such as TLS: by using DNS over TLS over TCP port 443 (the HTTP/TLS port), you should be able to avoid most filtering between you and the recursive server.

[...]

The GNU libc resolver has an (undocumented) option, use-vc (see resolv/res_init.c) to force the usage of TCP for DNS resolutions. This option is available since glibc v2.14 (available since Debian Jessie, since Ubuntu 12.04).

In /etc/resolv.conf:
options use-vc
nameserver 2001:913::8

[...]

Other libc implementations:
    * The OpenBSD libc seems to have a tcp option for this.
    * Neither the FreeBSD libc, nor the DragonFlyBSD libc, nor the NetBSD libc, not the bionic libc (used by Android and FirefoxOS), nor the Mac OS/X / Darwin libresolv, seem to have a similar option.
    * dietlibc does not handle the options at all (and does not support RES_USEVC and DNS/TCP).
    * uclibc and musl do not have the option and does not handle DNS/TCP at all.
    * klibc do not have real DNS resolution.

Similar libraries:
    * getdns does not handle the options field at all.

[...]


However, AFAIK, unbound currently (v1.5.1) does not verify the validity of the remote X.509 certificate (see connect_sslctx_create which is always called without the verifypem argument). In order to avoid MITM attacks, you might want to add a local stunnel between unbound and the remote DNS server.
[NDLR : 'tain... Tout le code derrière (if(verifypem && verifypem[0]) -> if(!SSL_CTX_load_verify_locations(ctx, verifypem, NULL)) [on indique où se trouve les certifs d'AC.] -> SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL) [vérification, SSL_VERIFY_PEER « the server certificate is verified. If the verification process fails, the TLS/SSL handshake is immediately terminated »] ) est prêt en plus :(  Je ne suis pas surpris, on avait ce même comportement de non authentification dans des librairies standards de certains langages comme python, php/curl, php/streams wrapper... et donc de vulnérabilité complète à une attaque active... ]

[...]

What about DNSSEC?
If your local resolver verify the authenticity of the DNS reply with DNSSEC, it will be able to detect a spoofed DNS reply and reject it. But it will still not be able to get the correct reply. So you should use DNSSEC but you might still want to use DNS/TLS. »