Unbound has a special mode for logging DNSSEC failures. It would be interesting to enable it and try the gov digs again from Virgin Media and see what it reports.
Setup
To enable it, first of all enable Unbound logging to a dedicated log file, as per the "Add logging to unbound" part of the Pi-hole guide. Don't forget to create the log file, set the permissions and do the AppArmor steps, as per the guide.
Then add the special logging mode val-log-level set to 2 ("At 2, not only the query that failed is printed but also the reason why Unbound thought it was wrong and which server sent the faulty data.")
So it looks like this once done:
$ sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf
server:
# If no logfile is specified, syslog is used
logfile: "/var/log/unbound/unbound.log"
log-time-ascii: yes
val-log-level: 2
verbosity: 0
...
Restart Unbound
sudo service unbound restart
Testing
Now try to access the gov sites again, try dig etc. Any failures will be logged with the details. Eg using the test domains to dig, seeing the failures then looking at the log.
$ dig fail03.dnssec.works @127.0.0.1 -p 5335
...
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 54208
...
$ dig fail04.dnssec.works @127.0.0.1 -p 5335
; <<>> DiG 9.16.42-Debian <<>> fail04.dnssec.works @127.0.0.1 -p 5335
;; global options: +cmd
;; connection timed out; no servers could be reached
Log
$ less /var/log/unbound/unbound.log
Sep 06 13:56:43 unbound[498765:0] info: validation failure <fail03.dnssec.works. A IN>: signature crypto failed from 5.45.109.212
Sep 06 13:57:02 unbound[498765:0] info: validation failure <fail03.dnssec.works. A IN>: signature crypto failed from 5.45.109.212
Sep 06 13:57:23 unbound[498765:0] info: validation failure <fail04.dnssec.works. A IN>: no keys have a DS with algorithm RSASHA1-NSEC3-SHA1 from 5.45.109.212 for key fail04.dnssec.works. while building chain of trust
Sep 06 13:57:23 unbound[498765:0] info: validation failure <fail04.dnssec.works. A IN>: no keys have a DS with algorithm RSASHA1-NSEC3-SHA1 from 5.45.109.212 for key fail04.dnssec.works. while building chain of trust
Sep 06 13:57:23 unbound[498765:0] info: validation failure <fail04.dnssec.works. A IN>: no keys have a DS with algorithm RSASHA1-NSEC3-SHA1 from 5.45.109.212 for key fail04.dnssec.works. while building chain of trust
Cleanup
It only logs failures so could be left on so it always catches a situation. To disable it edit the pi-hole.conf file and either set val-log-level to 0 (which means off) or comment the line out. Then restart Unbound the same way as earlier on.
If you wish to clear out the log file use the command:
sudo truncate -s 0 /var/log/unbound/unbound.log
