04 · What Unbound does here

Common shorthand: cache, forward, proxy — close. Two are exact; one needs a tweak.

Roles

✓ CACHE

Recursive caching resolver. Honours record TTLs; repeat lookups are answered locally and never cross Tailscale.

✓ FORWARD

forward-zone: "corp.internal" → the VPC's Route 53 Resolver inbound IPs. Everything else recurses to public DNS.

≈ PROXY

More precisely a forwarder. Unbound relays DNS queries upstream — it does not proxy application/HTTP traffic. Tailscale carries the packets end-to-end; Unbound just decides where the question goes.