Messages

I've re-read your OP several times to try to avoid a pointless contribution... (an opening comment like that almost guarantees one), but I'm pretty sure I'm achieving what you want to do only with unbound with a very similar setup.

I catch all local requests to my *.mxxxxxxx.org domain which are directed to a caddy reverse proxy container with a lan ip address.

We have some public code demo sites such as dev1, dev2 at dev1.mxxxxxx.org with public IP addresses. In Unbound overrides:

Host: *    Domain: mxxxxxxx.org          Value: 192.x.x.x   Descrip: Caddy Reverse Proxy
Host: *    Domain: dev1.mxxxxxx.org   Value: 20.x.x.x    Descrip: Public webserver IP address

Does this not work for you?

Just heard from Protectli support that they have been able to reproduce the issue and it's a different one all together, though similar effect. Essentially related to the coreboot bios. The workaround they suggested is to flash back to AMI bios for the time being

Ok, interesting. I'll check if makes any difference over the weekend if I can get to the site

Also seeing this on Protectli V1410. Will try the tunables, thanks