By default, Unbound DNS server works by "classic" scheme: queries root servers for zone NS records, then queries NS'es for A/AAAA/...
Sometime (rarely) connectivity between my DNS and target NS'es is failed, but target NS'es are still available from various LookingGlasses and from Google/Level3 DNS, so "nslookup www.target.com 18.104.22.168" and "nslookup www.target.com 22.214.171.124" returns the correct answer.
How to setup Unbound to use public forwarders when (and only after) direct query to the target NS'es is failed? The following config works fine, but routes all queries immediately to forwarders, ignoring target NS'es at all:
forward-zone: name: "." forward-first: no forward-addr: 126.96.36.199 forward-addr: 188.8.131.52