unbound DNS: can't list domains via nslookup

Question

I configured unbound DNS on a CentOS server and set a local-zone in it.And I have turned off the firewall on the server.
On Windows I tried to use the nslookup command to verify DNS records in unbound DNS, but the result is:

C:\Windows\system32>nslookup
Default Server:  UnKnown
Address:  192.168.0.161

> ls example.com
[UnKnown]
*** Can't list domain example.com: Query refused
The DNS server refused to transfer the zone example.com to your computer. If this
is incorrect, check the zone transfer security settings for example.com on the DNS
server at IP address 192.168.0.161.
> ns.example.com
server:  ns.example.com
Address:  192.168.0.161

Name:    ns.example.com
Address:  192.168.0.161

unbound.conf content on the server：

server:
local-zone: "example.com." static
local-data: "example.com. 86400 IN SOA ns.example.com. root 1 1D 1H 1W 1H"
local-data: "ns.example.com. IN A 192.168.0.161"
local-data-ptr: "192.168.0.161 ns.example.com."
access-control: 0.0.0.0/0 allow
interface: 0.0.0.0

Answer 1

I don't believe that your server is configured to allow zone transfer to your Windows test machine. The ls command is effectively requesting a zone transfer.

If possible (and I am not sure it is), configure the unbound server to allow zone transfer to the relevant IP.

In the meantime, try a normal type A record lookup and see if that works.

Answer 2

I think it would be better to start with a way much shorter, simpler, configuration. And see if you can resolve the name at the server first.