On my side I was also having the issue "queryNs ETIMEOUT" , and it was because my outbound UDP port 53 was not open.

I just had to add it like that on my Hetzner Cloud Firewall :

And that is all due to # Unbound is used primarily for RBL queries (host 2.0.0.127.zen.spamhaus.org) - which is not quite true / right anymore as well?

do-ip6: no in config doesn't help thought...

# host -t NS apple.com 127.0.0.150
;; communications error to 127.0.0.150#53: timed out
Using domain server:
Name: 127.0.0.150
Address: 127.0.0.150#53
Aliases:

Host apple.com not found: 2(SERVFAIL)

Do I have to pay attention to any follow-up measures? Or can I leave the administration to Cloudron again?

If I have changed any configurations, I don't know how, because normally I don't access the server via ssh, but let cloudron manage everything. I only use ssh for disk adjustments or specific instructions from the Cloudron interface.

However. I have started the reinstallation and will wait and see. It is currently taking a while (approx. 5 minutes). The latest message is Setting up unbound (1.19.2-1ubuntu3.3) ...

Thanks for the inputs so far !

You may also try, just to be sure to reinstall unbound and depending on ubuntu version also unbound-anchor:

apt reinstall  unbound unbound-anchor

root@...:~# /usr/sbin/unbound -dv
[1731569630] unbound[455868:0] notice: Start of unbound 1.19.2.

Are you able to run /usr/sbin/unbound -dv manually?

When I run apt list --installed | grep unbound there is an entry unbound/noble-updates,noble-security,now 1.19.2-1ubuntu3.3 amd64 [installed].

When I check for installable unbound packages, there are two:

unbound/noble-updates,noble-security,now 1.19.2-1ubuntu3.3 amd64 [installed]
unbound/noble 1.19.2-1ubuntu3 amd64

Do I need to install the second too?

[WARN]  Domain [domain.tld] expiry check skipped because whois does not have this information
        unbound is down. updating root anchor to see if it fixes it

systemd[1]: Starting unbound.service - Unbound DNS Resolver...
systemd[1]: unbound.service: Control process exited, code=exited, status=203/EXEC
systemd[1]: unbound.service: Failed with result 'exit-code'.

at genericNodeError (node:internal/errors:984:15)
at wrappedFn (node:internal/errors:538:14)
at ChildProcess.exithandler (node:child_process:422:12)
at ChildProcess.emit (node:events:518:28)
at maybeClose (node:internal/child_process:1105:16)
at Socket.<anonymous> (node:internal/child_process:457:11)
at Socket.emit (node:events:518:28)
at Pipe.<anonymous> (node:net:337:12) {
	code: 3,
	killed: false,
	signal: null,
	cmd: 'systemctl is-active unbound'
}
Nov 13 14:55:55 box:shell statusUnbound: systemctl with args is-active unbound errored Error: Command failed: systemctl is-active unbound

Could that help to solve the Problem?

You can also check this via SSH using systemctl status unbound

Any ideas what I could try?

Thanks a lot!

I've managed to solve this now.

Thanks for your help.

I've run the command and get this as the output

xx.co.uk name server liz.ns.cloudflare.com.
xx.co.uk name server albert.ns.cloudflare.com.