AdGuardHome not able tu use unbound as a TLS upstream

[msalhi]

Hello all,

I've set-up in a debian 13 unbound to do recursive DNS resolution.
The service is working fine, listening on port 5335 for regular DNS requests and on port 853 for DNS-over-TLS (DoT).
I've tested my unbound setup and everything works perfectly (TLS, DNSSEC, cache, ...)
FYI : I've created a local CA and certificates for TLS.

My AdGuard is able to forward DNS requests to my unbound via UDP port (Regular DNS Request).
Now, I want my AdGuardHome to forward DNS requests to unbound using TLS so I've replaced
upstream_dns: - 127.0.0.1:5335
with

upstream_dns: - tls://127.0.0.1:853

But when I click the "Test upstreams" button it fail and even simple DNS requests to my AdGuardHome fail.

I need some help please.
Thank you !

[yyzguy]

Why on earth would you want to use TLS to transfer data on localhost?

[msalhi]

As a test purpose. I know that DoT is not too ressource consuming and I want to secure all the traffic in my network Clients > AdGuard > Unbound.

[msalhi]

And I was curious why AdGuardHome is not able to contact my unbound over TLS

[Dynamic5912]

There's no need to send to unbound using TLS.

[msalhi]

Like I said it's a test in localhost. In prod my unbound will be on another machine and who knows potentially on another subnet.

I'm not asking for and don't want to debate on the need. I'm trying to understand why it doesn't work.

Adguardhome is supposed to be able to reach a tls upstream but not mine which works perfectly.

[Dynamic5912]

Like I said it's a test in localhost. In prod my unbound will be on another machine and who knows potentially on another subnet.

I'm not asking for and don't want to debate on the need. I'm trying to understand why it doesn't work.

Adguardhome is supposed to be able to reach a tls upstream but not mine which works perfectly.

What DNS are you using with Unbound?

Are you just using the authoritative root servers or have you specified a third-party DNS - just out of interest?

[msalhi]

Only the root servers.
Thanks for your interest :)

[Dynamic5912]

Which are sent unencrypted and returned unencrypted.