Problems with unbound

[Eugene Grosbein]

15.03.2016 21:55, Andrea Brancatelli пишет:
> Hi, the machine is connected "directly enough" (it's in a datacenter) to
> safely excude point 1.

Contrary, datacenters are known to have dumb filters dropping
fragmented UDP packets that are essential for DNSSEC,
so the "point 1" is most probable reason.

Please take a look at this article:
https://kb.isc.org/article/AA-01219/0/Refinements-to-EDNS-fallback-behavior-can-cause-different-outcomes-in-Recursive-Servers.html

4th paragraph is probably your case.