In my experience with unbound, it tends to return expired records in the hope that they are still valid, causing issues with services hosted in the cloud, where IP addresses rotate regularly. What I did was update the serve-expired-ttl setting in unbound’s configuration to 3 hours (down from the default 24h)

Ah, good idea! I just don’t have any non-magnetic screwdriver at home, I’m afraid as to what might happen if I get its magnetic tip close to a drive.