unbound: explicitly enable ede and it's log

etc/unbound/unbound.conf.d/cache.conf

@@ -23,5 +23,8 @@ server:
 	# Allow expired results to be served if they are in cache. The cache will
 	# get updated the next time.
 	serve-expired: yes
+	# DNSSEC errors for valid and expired records
+	ede: yes
+	ede-serve-expired: yes
 
 # vim: filetype=unbound.conf

etc/unbound/unbound.conf.d/logging.conf

@@ -6,6 +6,9 @@ server:
 	# gives query level information, output per query.  Level  4  gives
 	# algorithm  level  information.
 	verbosity: 2
+	# Gives validation EDEs more comprehensive human-readable errors
+	# https://blog.nlnetlabs.nl/extended-dns-error-support-for-unbound/
+	val-log-level: 2
 	# Print statistics to the log hourly
 	statistics-interval: 3600