Keep a local copy of the OpenNIC root zone

README.md

@@ -203,6 +203,11 @@ In OpenNIC mode:
 
 - Unbound bootstraps from the OpenNIC root servers (`opennic.hints`) and never
   contacts the ICANN root servers, internic.net, or IANA.
+- Unbound keeps a local copy of the root zone, transferred from those same root
+  servers, so delegations come from a complete zone instead of from referrals
+  cached per query. This mirrors what the ICANN path does with the root zone
+  from internic.net. If the transfer fails, Unbound falls back to querying the
+  root servers directly.
 - DNSSEC validation is anchored to the OpenNIC root key (`opennic.key`) and
   kept up to date automatically (RFC 5011). The OpenNIC root also serves the
   DS records of the ICANN TLDs, so DNSSEC keeps working for the regular

unbound.sh

@@ -147,6 +147,26 @@ server:
   root-hints: "opennic.hints"
   auto-trust-anchor-file: "var/opennic.key"
 EOT
+
+    # Keep a local copy of the root zone, like the ICANN path does. Without it
+    # every delegation is a cached referral from whichever root server answered,
+    # so a single server serving stale data can break a TLD until the cache
+    # expires. Slaved from the servers already in opennic.hints, so this adds no
+    # dependency beyond the root servers Unbound is configured to use.
+    opennic_masters=$(awk '$1 !~ /^;/ && $3 == "A" { printf "  master: %s\n", $4 }' \
+        /opt/unbound/etc/unbound/opennic.hints)
+    if [ -n "$opennic_masters" ]; then
+        cat >>/opt/unbound/etc/unbound/unbound.conf <<EOT
+
+auth-zone:
+  name: "."
+${opennic_masters}
+  fallback-enabled: yes
+  for-downstream: no
+  for-upstream: yes
+  zonefile: "var/opennic-root.zone"
+EOT
+    fi
 else
     cat >>/opt/unbound/etc/unbound/unbound.conf <<EOT