Cloned from: https://issues.redhat.com/browse/RHEL-95374

When running IPA installer with dns-over-tls option enabled and enforced eDNS policy, unbound service won't start, failing with:

unbound-checkconf: warning: forward-addr: '127.0.0.1' is specified for forward-zone: '.', but do-not-query-localhost: yes means that the address will not be used for lookups

This happens because the prerequirement we have for enabling discovery uses dnsconfd. When dnsconfd is enabled, it setups a new unbound configuration:

[root@replica1 conf.d]# cat unbound.conf
server:
include: /run/dnsconfd/unbound.conf
[root@replica1 conf.d]# cat /run/dnsconfd/unbound.conf
server:
module-config: "ipsecmod iterator"
interface: 127.0.0.1
do-not-query-address: 127.0.0.1/8
tls-cert-bundle: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
forward-zone:
name: "."
forward-addr: "127.0.0.1"

This deploys a forward zone in 127.0.0.1, which conflicts with the unbound configuration provided by IPA. The include from unbound.conf should be commented out.