That domain does not seem to be available anymore.
Use the DNSSEC test servers as updated in our guide:
dig fail01.dnssec.works @127.0.0.1 -p 5335
dig dnssec.works @127.0.0.1 -p 5335
Note that DNSSEC requires accurate time information.
The times from your dig results and logs do not seem to match - one instance I've checked they differ for about 10 minutes.
This may just be a result of extracting logs for a different time frame, but still:
You want to verify that your unbound host machine has correct time and time zone information.