Yes that is right and no i did not check the packets, but what else send ipfire over UDP Port 53 to one of 13 root DNS server ? I recognized this behavior for the first time, so for a long time this connections were made without my knowing. anyway…
So if now they are blocked, it means nothing for the past, BUT ….. I have found a very nice feature for unbound and will tell the story here a little further.