add commented-out "val-log-level: 2" next to the uncommentable line to

enable dnssec validation, it's really useful for debug

src/etc/unbound.conf

@@ -1,4 +1,4 @@
-# $OpenBSD: unbound.conf,v 1.12 2018/12/11 19:16:36 florian Exp $
+# $OpenBSD: unbound.conf,v 1.13 2018/12/12 23:20:38 sthen Exp $
 
 server:
 	interface: 127.0.0.1
@@ -22,6 +22,7 @@ server:
 	# Uncomment to enable DNSSEC validation.
 	#
 	#auto-trust-anchor-file: "/var/unbound/db/root.key"
+	#val-log-level: 2
 
 	# Uncomment to synthesize NXDOMAINs from DNSSEC NSEC chains
 	# https://tools.ietf.org/html/rfc8198